Microsoft Identity platform Cheatsheet

By Saeed Salehi

5 min read

Authors

Part of series

Developing Solutions for Microsoft Azure (AZ-204) certification exam Cheatsheets

  1. Part 1:

    Introduction to (AZ-204) certification exam Cheatsheets

  2. Part 2:

    Implement IaaS in Azure Cheatsheets

  3. Part 3:

    Azure Functions Cheatsheets

  4. Part 4:

    Azure App Service Cheatsheets

  5. Part 5:

    Develop solutions that use Blob storage Cheatsheets

  6. Part 6:

    Develop solutions that use Azure Cosmos DB Cheatsheets

  7. Part 7:

    Implement Azure Security Cheatsheet

  8. Part 8:

    Microsoft Identity platform Cheatsheet

  9. Part 9:

    Monitoring And logging in Azure Cheatsheets

  10. Part 10:

    Azure Cache for Redis Cheatsheets

  11. Part 11:

    Develop message-based solutions Cheatsheets

  12. Part 12:

    Develop event-based solutions Cheatsheets

  13. Part 13:

    API Management in Azure Cheatsheets

Service Principals

  • Single tenant: only accessible in your tenant
  • Multi-tenant: accessible in other tenants

Application object

global representation of your application for use across all tenants,

An application object is used as a template or blueprint to create one or more service principal objects.

the application object has some static properties that are applied to all the created service principals (or application instances).

Service principal object

service principal is the local representation for use in a specific tenant.

The security principal defines the access policy and permissions for the user/application in the Azure Active Directory tenant.

Types of service principal:

  • Application - This type of service principal is the local representation, or application instance, of a global application object in a single tenant or directory.
  • Managed identity: Managed identities provide an identity for applications to use when connecting to resources that support Azure Active Directory
  • Legacy - This type of service principal represents a legacy app, which is an app created before app registrations were introduced or an app created through legacy experiences

Relation

An application object has:

  • A 1:1 relationship with the software application,
  • A 1:many relationship with its corresponding service principal object(s).

Permissions and Consent

Implements the OAuth 2.0 authorization protocol. (scope , application ID URI) types of permissions:

  • Delegated permissions are used by apps that have a signed-in user present.

  • Application permissions are used by apps that run without a signed-in user present,like background services or daemons. Only an administrator can consent to application permissions.

Consent types

  • Static user consent
  • Incremental and dynamic user consent
  • Admin consent

Static user consent

In the static user consent scenario, you must specify all the permissions it needs in the app's configuration in the Azure portal. If the user (or administrator, as appropriate) has not granted consent for this app, then Microsoft identity platform will prompt the user to provide consent at this time.

Incremental and dynamic user consent

You can ask for a minimum set of permissions upfront and request more over time as the customer uses additional app features.

Admin consent

Admin consent ensures that administrators have some additional controls before authorizing apps or users to access highly privileged data from the organization.

Requesting individual user consent

OpenID Connect or OAuth 2.0 authorization request, an app can request the permissions it needs by using the scope query parameter. scope parameter is a space-separated list of delegated permissions that

Conditional access

  • Multifactor authentication
  • Allowing only Intune enrolled devices to access specific services
  • Restricting user locations and IP ranges

the following scenarios require code to handle Conditional Access challenges:

  • Apps performing the on-behalf-of flow
  • Apps accessing multiple services/resources
  • Single-page apps using MSAL.js
  • Web apps calling a resource

Microsoft Authentication Library (MSAL)

Authentication flows

Authorization codeNative and web apps securely obtain tokens in the name of the user
Client credentialsService applications run without user interaction
On-behalf-ofThe application calls a service/web API, which in turns calls Microsoft Graph
ImplicitUsed in browser-based applications
Device codeEnables sign-in to a device by using another device that has a browser
Integrated WindowsWindows computers silently acquire an access token when they are domain joined
InteractiveMobile and desktops applications call Microsoft Graph in the name of a user
Username/passwordThe application signs in a user by using their username and password

Categories:

  • Public client applications: Are apps that run on devices or desktop computers or in a web browser. They're not trusted to safely keep application secrets, so they only access web APIs on behalf of the user. (They support only public client flows.) they don't have client secrets.

  • Confidential client applications: Are apps that run on servers (web apps, web API apps, or even service/daemon apps). They're considered difficult to access, and for that reason capable of keeping an application secret. Confidential clients can hold configuration-time secrets

client applications

IPublicClientApplication app = PublicClientApplicationBuilder.Create(clientId).Build();

string redirectUri = "https://myapp.azurewebsites.net";
IConfidentialClientApplication app = ConfidentialClientApplicationBuilder.Create(clientId)
    .WithClientSecret(clientSecret)
    .WithRedirectUri(redirectUri )
    .Build();

Modifiers common to public and confidential client applications

ModifierDescription
.WithAuthority()Sets the application default authority to an Azure Active Directory authority, with the possibility of choosing the Azure Cloud, the audience, the tenant (tenant ID or domain name), or providing directly the authority URI.
.WithTenantId(string tenantId)Overrides the tenant ID, or the tenant description.
.WithClientId(string)Overrides the client ID.
.WithRedirectUri(string redirectUri)Overrides the default redirect URI. In the case of public client applications, this will be useful for scenarios requiring a broker.
.WithComponent(string)Sets the name of the library using MSAL.NET (for telemetry reasons).
.WithDebugLoggingCallback()If called, the application will call Debug.Write simply enabling debugging traces.
.WithLogging()If called, the application will call a callback with debugging traces.
.WithTelemetry(TelemetryCallback telemetryCallback)Sets the delegate used to send telemetry.

Modifiers specific to confidential client applications

ModifierDescription
.WithCertificate(X509Certificate2 certificate)Sets the certificate identifying the application with Azure Active Directory.
.WithClientSecret(string clientSecret)Sets the client secret (app password) identifying the application with Azure Active Directory.

Sample Code:

private const string _clientId = "APPLICATION_CLIENT_ID";
        private const string _tenantId = "DIRECTORY_TENANT_ID";

        public static async Task Main(string[] args)
        {
            var app = PublicClientApplicationBuilder
                .Create(_clientId)
                .WithAuthority(AzureCloudInstance.AzurePublic, _tenantId)
                .WithRedirectUri("http://localhost")
                .Build();
            string[] scopes = { "user.read" };
            AuthenticationResult result = await app.AcquireTokenInteractive(scopes).ExecuteAsync();

            Console.WriteLine($"Token:\t{result.AccessToken}");
        }

Shared Access Signatures (SAS)

A shared access signature (SAS) is a signed URI that points to one or more storage resources and includes a token that contains a special set of query parameters.

Types of shared access signatures

  • User delegation SAS: A user delegation SAS is secured with Azure Active Directory credentials and also by the permissions specified for the SAS. A user delegation SAS applies to Blob storage only.

  • Service SAS: A service SAS is secured with the storage account key. A service SAS delegates access to a resource in the following Azure Storage services: Blob storage, Queue storage, Table storage, or Azure Files.

  • Account SAS: An account SAS is secured with the storage account key. An account SAS delegates access to resources in one or more of the storage services. All of the operations available via a service or user delegation SAS are also available via an account SAS.

Creating a stored access policy

az storage container policy create \
    --name <stored access policy identifier> \
    --container-name <container name> \
    --start <start time UTC datetime> \
    --expiry <expiry time UTC datetime> \
    --permissions <(a)dd, (c)reate, (d)elete, (l)ist, (r)ead, or (w)rite> \
    --account-key <storage account key> \
    --account-name <storage account name> \

Upcoming events

  • Mastering Event-Driven Design

    PLEASE RSVP SO THAT WE KNOW HOW MUCH FOOD WE WILL NEED Are you and your team struggling with event-driven microservices? Join us for a meetup with Mehmet Akif Tütüncü, a senior software engineer, who has given multiple great talks so far and Allard Buijze founder of CTO and founder of AxonIQ, who built the fundaments of the Axon Framework. RSVP for an evening of learning, delicious food, and the fusion of creativity and tech! 🚀 18:00 – 🚪 Doors open to the public 18:15 – 🍕 Let’s eat 19:00 – 📢 Getting Your Axe On Event Sourcing with Axon Framework 20:00 – 🍹 Small break 20:15 – 📢 Event-Driven Microservices - Beyond the Fairy Tale 21:00 – 🙋‍♀️ drinks 22:00 – 🍻 See you next time? Details: Getting Your Axe On - Event Sourcing with Axon Framework In this presentation, we will explore the basics of event-driven architecture using Axon Framework. We'll start by explaining key concepts such as Event Sourcing and Command Query Responsibility Segregation (CQRS), and how they can improve the scalability and maintainability of modern applications. You will learn what Axon Framework is, how it simplifies implementing these patterns, and see hands-on examples of setting up a project with Axon Framework and Spring Boot. Whether you are new to these concepts or looking to understand them more, this session will provide practical insights and tools to help you build resilient and efficient applications. Event-Driven Microservices - Beyond the Fairy Tale Our applications need to be faster, better, bigger, smarter, and more enjoyable to meet our demanding end-users needs. In recent years, the way we build, run, and operate our software has changed significantly. We use scalable platforms to deploy and manage our applications. Instead of big monolithic deployment applications, we now deploy small, functionally consistent components as microservices. Problem. Solved. Right? Unfortunately, for most of us, microservices, and especially their event-driven variants, do not deliver on the beautiful, fairy-tale-like promises that surround them.In this session, Allard will share a different take on microservices. We will see that not much has changed in how we build software, which is why so many “microservices projects” fail nowadays. What lessons can we learn from concepts like DDD, CQRS, and Event Sourcing to help manage the complexity of our systems? He will also show how message-driven communication allows us to focus on finding the boundaries of functionally cohesive components, which we can evolve into microservices should the need arise.

    | Coven of Wisdom - Utrecht

    Go to page for Mastering Event-Driven Design

  • The Leadership Meetup

    PLEASE RSVP SO THAT WE KNOW HOW MUCH FOOD WE WILL NEED What distinguishes a software developer from a software team lead? As a team leader, you are responsible for people, their performance, and motivation. Your output is the output of your team. Whether you are a front-end or back-end developer, or any other discipline that wants to grow into the role of a tech lead, RSVP for an evening of learning, delicious food, and the fusion of leadership and tech! 🚀 18:00 – 🚪 Doors open to the public 18:15 – 🍕 Let’s eat 19:00 – 📢 First round of Talks 19:45 – 🍹 Small break 20:00 – 📢 Second round of Talks 20:45 – 🙋‍♀️ drinks 21:00 – 🍻 See you next time? First Round of Talks: Pixel Perfect and Perfectly Insane: About That Time My Brain Just Switched Off Remy Parzinski, Design System Lead at Logius Learn from Remy how you can care for yourself because we all need to. Second Round of Talks: Becoming a LeadDev at your client; How to Fail at Large (or How to Do Slightly Better) Arno Koehler Engineering Manager @ iO What are the things that will help you become a lead engineer? Building Team Culture (Tales of trust and positivity) Michel Blankenstein Engineering Manager @ iO & Head of Technology @ Zorggenoot How do you create a culture at your company or team? RSVP now to secure your spot, and let's explore the fascinating world of design systems together!

    | Coven of Wisdom - Amsterdam

    Go to page for The Leadership Meetup

  • Coven of Wisdom - Herentals - Spring `24 edition

    Join us for an exciting web technology meetup where you’ll get a chance to gain valuable insights and knowledge about the latest trends in the field. Don’t miss out on this opportunity to expand your knowledge, network with fellow developers, and discover new and exciting possibilities. And the best part? Food and drinks are on us! Johan Vervloet - Event sourced wiezen; an introduction to Event Sourcing and CQRS Join me on a journey into the world of CQRS and Event Sourcing! Together we will unravel the misteries behind these powerful concepts, by exploring a real-life application: a score app for the 'Wiezen' card game.Using examples straight from the card table, we will delve into the depths of event sourcing and CQRS, comparing them to more traditional approaches that rely on an ORM.We will uncover the signs in your own database that indicate where event sourcing can bring added value. I will also provide you with some tips and pointers, should you decide to embark on your own event sourcing adventure. Filip Van Reeth - WordPress API; "Are you talking to me?" What if the WordPress API could be one of your best friends? What kind of light-hearted or profound requests would it share with you? In this talk, I would like to introduce you to it and ensure that you become best friends so that together you can have many more pleasant conversations (calls). Wanna be friends? Please note that the event or talks will be conducted in Dutch. Want to give a talk? Send us your proposal at meetup.herentals@iodigital.com 18:00 - 19:00: Food/Drinks/Networking 19:00 - 21:00: Talks 21:00 - 22:00: Networking Thursday 30th of May, 18h00 - 22h00 CET iO Campus Herentals, Zavelheide 15, Herentals

    | Coven of Wisdom Herentals

    Go to page for Coven of Wisdom - Herentals - Spring `24 edition

Share

Jobs

Senior .NET Developer

Utrecht, Utrecht, Nederland

Senior Web Developer

Sofia, Sofia, Bulgarije

.Net Developer

Antwerpen, Vlaams Gewest, België

.Net Backend Developer / Software Engineer

Amsterdam, Noord-Holland, Nederland

View all jobs