Restrict Azure CDN downloads to Azure AD Group

scoll 1 Reputation point
2020-08-01T15:07:24.303+00:00

I want to restrict READ access to my CDN resources to distributed clients who I assign to an Azure AD group and send their own client-id/secret to authenticate with a bearer token. The clients have already demonstrated the ability to do this with Enterprise ADFS, so this is not a question of their ability to obtain the token, but rather Azure CDN/AD settings.

1) Can I do this?
2) Is there a doc that explains how?
3) Will this track downloads by client?

Microsoft Entra
Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
19,595 questions
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. AmanpreetSingh-MSFT 56,311 Reputation points
    2020-08-05T13:19:37.067+00:00

    Hi @scoll

    From your question I understood that you are using client_credentials flow to authenticate the service principal (application/client) and want to pass service principal's Group Membership as claim in the bearer token. Based on which your application can perform authorization decision that whether to provide read access to CDN resources or not. Please correct me if my understanding is not right.

    I am answering below questions based on the above understanding:

    1) Can I do this? YES
    2) Is there a doc that explains how? : Configure the Azure AD Application Registration for group attributes
    3) Will this track downloads by client? : You can check the Activity Logs for this purpose.

    In short, to get Group Claim, you need to set "groupMembershipClaims": "All" in the Manifest of the client application that you used to obtain the token.

    Note : There is a limit of 150 groups for a SAML token, and 200 for a JSON Web Token (JWT).

    Please do "Accept the answer" if you find the information helpful. This will help us and others in the community as well.

    0 comments