How to distribute the app which is created on entra.

Question

How to distribute the app which is created on entra.

asvr asvr 25

How to distribute the application or what are the ways to distribute it between different organisations?

asvr asvr 25 Reputation points

2024-04-11T11:57:17.33+00:00

CarlZhao-MSFT could you please answer me on this one ?
Shweta Mathur 30,296 Reputation points Microsoft Employee Moderator

2024-04-12T07:23:53.4733333+00:00

@asvr asvr

Just checking in to see if the below answer helped. If this answers your query, please don’t forget to click "Accept Answer" and Up-Vote for the same, which might be beneficial to other community members reading this thread. And, if you have any further query do let us know.

Accepted answer

2 additional answers

Your answer

asvr asvr 25 Reputation points

2024-04-11T11:57:17.33+00:00

CarlZhao-MSFT could you please answer me on this one ?
Shweta Mathur 30,296 Reputation points Microsoft Employee Moderator

2024-04-12T07:23:53.4733333+00:00

@asvr asvr

Just checking in to see if the below answer helped. If this answers your query, please don’t forget to click "Accept Answer" and Up-Vote for the same, which might be beneficial to other community members reading this thread. And, if you have any further query do let us know.

Answer 1

asvr asvr

Make sure to login in your multi-tenant API with user of another Tenant using

https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id={client-id of Tenant A API}&response_type=code&redirect_uri={redirect URI registered in Tenant A API}&response_mode=fragment&scope=openid%20offline_access%20https%3A%2F%2Fgraph.microsoft.com%2F.default&state=12345 which will ask for user's consent

Once the consent is provided, the service principal object of API of Tenant A gets registered in Tenant B. This API now can be found under Enterprise Registration Blade of AAD in Tenant B.

Here Tenant A is where you register your application.

Reference -https://learn.microsoft.com/en-us/entra/identity-platform/howto-convert-app-to-be-multi-tenant

Hope this will help.

Thanks,

Shweta

Please remember to "Accept Answer" if answer helped you.

Answer 2

Marcin Policht 50,730 MVP Volunteer Moderator

You don't distribute it - you make it available to other organizations. To accomplish this, implement the app as multi-tenant.

More at https://learn.microsoft.com/en-us/entra/identity-platform/single-and-multi-tenant-apps

and https://merill.net/2023/04/azure-ad-multi-tenant-app-vs-single-tenant-app/

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin

asvr asvr 25 Reputation points

2024-04-19T14:27:57.1633333+00:00

But whenever I'm trying to authorise other organisation users which is a different microsoft account then it is giving me error that user is not part of tenant with the specified tenant id

Shweta Mathur Marcin Policht
asvr asvr 25 Reputation points

2024-04-19T14:29:35.1166667+00:00

Yes i have created the app with this option only i.e. Allow to multi-tenant.. when I was trying to create the app.
Marcin Policht Shweta Mathur
Shweta Mathur 30,296 Reputation points Microsoft Employee Moderator

2024-04-25T05:07:25.08+00:00

Hi asvr asvr ,

Did you get a chance to look to above solution.
asvr asvr 25 Reputation points

2024-04-26T12:28:32.82+00:00
What is the max expiration time duration obtained in the respone of token url .
https://login.microsoftonline.com/common/oauth2/v2.0/token

"expires_in": 4051,

Shweta Mathur
Shweta Mathur 30,296 Reputation points Microsoft Employee Moderator

2024-04-30T04:36:50.7166667+00:00

asvr asvr

The access token expiration time is usually 60-90 minutes. However, you can acquire new access token automatically without any intervention from user using refresh token

Reference - https://learn.microsoft.com/en-us/entra/identity-platform/access-tokens#token-lifetime

https://learn.microsoft.com/en-us/entra/identity-platform/refresh-tokens
asvr asvr 25 Reputation points

2024-04-30T11:57:41.86+00:00

Shweta Mathur Thank you.
I saw the above refresh token URL so refresh code will work for atleast 24 hours. What is the case when it expires in 90 days. Could you please tell me about that?
Shweta Mathur 30,296 Reputation points Microsoft Employee Moderator

2024-05-02T04:57:35.29+00:00

asvr asvr

By default, Refresh token MaxInactiveTime will be 90 days and MaxAgeMultiFactor will be until revoked. As we are using the refresh token every day to get access token, means the refresh token should not expire (as MaxInactiveTime 90 days condition will never be met).

Only in case of single page apps, the default lifetime for the refresh tokens is 24 hours and 90 days for all other scenarios.

Answer 3

asvr asvr 25

Shweta Mathur Yes it worked. Thank you :) for your response.

asvr asvr 25 Reputation points

2024-07-25T11:45:51.9266667+00:00

Hey Shweta Mathur

I'm getting this error could you pls suggest how it can be resolved as i have the active subscription.

AADSTS500014: The service principal for resource 'ab3be6b7-f5df-413d-ac2d-abf1e3fd9c0b' is disabled. This indicate that a subscription within the tenant has lapsed, or that the administrator for this tenant has disabled the application, preventing tokens from being issued for it. Trace ID: dae4047b-099a-443a-902f-f0f77b53e800 Correlation ID: d92600df-91ae-4ae5-89bc-4046d38e3f01 Timestamp: 2024-07-25 11:34:42Z] with root cause

Share via

How to distribute the app which is created on entra.

2 additional answers

Your answer