How to deploy Managed Application with WebApp and single sign-on (Entra ID)

Nicolai Petri 5

Hi,

I hope someone can help me to figure out a way to solve our challenge with deploying our Azure Managed Application thru marketplace.

Currently we have done an application that consists of a Azure WebApp and a storage account.

Our challenge is that when we deploy the web app into the customers tenant (e.g. custapp.azurewebsites.net), we need to have an Entra Id app registration with client id and client secret. We also need to ensure that the App registration is configured with correct callback url (e.g. https://custapp.azurewebsites.net/signin-oidc).
Have anyone solved this so customers can easily on-board a webapps with Entra ID signin as managed applications ?

Kind regards,

Nicolai Petri

1 answer

Deepanshukatara-6769 10,300 Reputation points

2023-10-27T10:38:46.0166667+00:00
Hi , hope doing well

To address your query , please check below

Automate the Configuration:

Create a script or automation process that configures the Azure Web App and Azure AD App Registration with the required settings. This script should:

Create the Azure AD App Registration.

Set the correct callback URL (e.g., https://custapp.azurewebsites.net/signin-oidc) for the App Registration.

Grant the necessary permissions.

Retrieve and store the Client ID and Client Secret securely.

Update the Azure Web App settings with the Client ID and other configuration details.
Please sign in to rate this answer.
Deepanshukatara-6769 10,300 Reputation points

2023-10-27T10:40:01.53+00:00

please accept answer if it has helped

Nicolai Petri 5 Reputation points

2023-10-27T10:47:25.92+00:00

Hi Deepanshu,
Thanks you for the proposal but as far as I can see this will not really solve the main issue.
I can create a powershell script that provisions and app registration and updates app configuration (or a key vault), but I cannot run this during the deployment from Azure Marketplace without creating a User Defined Identity to run the script as. So asking user upfront for creating the user defined identity is not much better than asking the user to create the app registration manually.
Running the script from the ARM / Bicep deployment would work great if it could be executed with the permissions of the user deploying from Azure Marketplace.

Kind regards,
Nicolai Petri

Deepanshukatara-6769 10,300 Reputation points

2023-10-27T10:53:52.6+00:00

Hi Nicholai

I understand your concern. It seems that you want to simplify the onboarding process for your Azure Managed Application, specifically for configuring the Azure AD App Registration with the required client ID, client secret, and callback URL during deployment from the Azure Marketplace.

Indeed, executing a PowerShell script during deployment can be a viable solution, but you correctly pointed out that creating a User Defined Identity (Managed Identity) and running the script as the identity may not be an ideal user experience because it still involves manual steps.

To automate the deployment of your Azure Managed Application and the associated App Registration with Entra ID sign-in, here's an approach you can consider:

Integration with Azure Logic Apps or Azure Functions:

You can use Azure Logic Apps or Azure Functions as part of your deployment process. These serverless services can be triggered during deployment and perform actions on behalf of the user deploying the Managed Application.

Azure Managed Application Custom Operations:

Custom operations allow you to extend the deployment process of your Managed Application. You can define a custom operation that runs your PowerShell script, creating the App Registration and configuring it with the necessary settings.

Managed Identity for Azure Logic Apps/Azure Functions:

Use a Managed Identity for your Azure Logic App or Azure Function to ensure secure access to Azure resources without requiring the end-user to set up a separate identity. This eliminates the need for users to create a User Defined Identity.

ARM Template or Bicep Integration:

Integrate your Azure Logic App or Azure Function into your ARM template or Bicep file. You can call the custom operation to execute your PowerShell script during the deployment process. This allows the user to initiate the script without needing to manage identities manually.

Remember that this is a high-level overview, and the specific implementation details can be customized according to your application's requirements

And I can recommend arm template and bicep integration one

Thanks!

Nicolai Petri 5 Reputation points

2023-10-27T11:27:50.1466667+00:00

Hi Deepanshu,

Thanks again for the follow up. Maybe you have futher information or examples of one of the above solutions ? It looks a bit like a what ChatGPT would provide of answers, and looking into details I don't think any of above is possible. We already deploy web app with managed identity, but there is no way to grant that permissions to create App Registration during the deployment based on the security context of the user deploying the solution.

I hope I miss something here, so a real example would be grant.

Kind regards,
Nicolai Petri

Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

How to deploy Managed Application with WebApp and single sign-on (Entra ID)

1 answer

Your answer