When developers build applications in Azure, they use Microsoft Entra ID to manage identity and access control. This system relies on creating a unique identity for each application, which allows the application to authenticate securely and request access to resources. By establishing these identities, developers can enforce the principle of least privilege and protect data as it moves between different services.
App Registration and Configuration
The setup process begins when a developer creates an app registration within the Microsoft Entra admin center. During this step, the developer must specify the app name, configure a redirect URI to receive authentication tokens, and choose the supported account types. Selecting the right account type defines the trust boundary and determines who can sign into the application:
- Single-tenant restricts access to accounts within the same directory where the app is registered.
- Multi-tenant allows accounts from any Microsoft Entra directory to sign in.
- Personal Microsoft accounts enable users with consumer accounts, such as Xbox or Outlook, to log in.
After registration, developers can define application roles within the app registration. These roles assign specific permissions to users or groups, allowing the application to check roles during the authorization process. This configuration ensures that only authorized users can perform sensitive actions inside the application.
Implementing Permissions and Authentication
To access secured data, applications request access tokens using industry-standard protocols like OAuth 2.0 and OpenID Connect. Applications can request specific API permissions that define what resources they can access and what actions they can perform. These permissions are categorized into delegated permissions, which run on behalf of a signed-in user, and application permissions, which run without a signed-in user.
