Can an Azure App Service be tied to a client's external Azure AD?

user_15584014 0
Viewed 36

We have written some code (I hesitate to use the term "application") in .NET Core using Visual Studio 2019. This concept is relatively simple; when a user opens a "proprietary" Excel workbook (an Excel file that calls our code) the code goes out to a hosted (by us) Azure SQL Managed database and returns data based on the parameters passed in by the user.

In Azure, we have a single production App Service plan with an App Service dedicated to each client (company). My question is about security: I'd like to tie each App Service to the related company's Azure AD. I do NOT want to create an account on my Azure AD for each user, although I can certainly do this through the "invitation" process using B2B. Can each App Service be "pointed" to a specific external instance of Azure AD so that only users from that company can access the related data?

Thanks.

azure-active-directory azure-web-app-service azure
1 Answers

You may use two different flows:

  • Each WebApp will authenticate users from only one specific Azure AD tenant
  • One WebApp will authenticate users from multiple Azure AD tenants

Both solution can be achieved with Azure AD multi-tenant authentication application pattern.

Here are steps you need to implement:

  • Update App registration to be multi-tenant
  • Update your code to send requests to /common
  • Update your code to handle multiple/single issuer values

Here is a picture that describes the flow

enter image description here

https://docs.microsoft.com/en-us/azure/active-directory/develop/howto-convert-app-to-be-multi-tenant

user_149445680
Related