Authentication & communication between backend applications on different Azure tenants

Question

Authentication & communication between backend applications on different Azure tenants

Jarod Kurland 146

Originally posted this here, but reposting here for visibility.

I have a regular 'primary' tenant for an organization that contains multiple internal applications. I'll refer to this as tenant A.
For the same (physical) company, I have setup a B2C tenant in Azure, which will host a public-facing/external application. I'll refer to this as tenant B.

For the application under tenant B, I'm looking to facilitate the communication for its backend to call the backend of another application under tenant A.

I would have exposed an API on the application for tenant A, and given the App Registration under tenant B the permission to use said API, however, this can't be done as they're in different tenants
What I'm thinking of doing, for now, is creating a separate App Registration in tenant A which the backend of the application in tenant B will get an auth token for using a Daemon auth flow (since it's application-to-application communication), but this seems a little unnecessary

Is this setup possible?

Shweta Mathur 30,296 Reputation points Microsoft Employee Moderator

2022-11-04T04:23:28.377+00:00

Hi @Jarod Kurland ,

Just checking in to see if the below answer helped. If this answers your query, please don’t forget to click "Accept the answer" and Up-Vote for the same, which might be beneficial to other community members reading this thread. And, if you have any further query do let us know.

Thanks,
Shweta
Shweta Mathur 30,296 Reputation points Microsoft Employee Moderator

2022-11-14T06:16:16.19+00:00

Hi @Jarod Kurland ,

Just checking in to see if the below answer helped. If this answers your query, please don’t forget to click "Accept the answer" and Up-Vote for the same, which might be beneficial to other community members reading this thread. And, if you have any further query do let us know.

Thanks,
Shweta

Accepted answer

0 additional answers

Your answer

Shweta Mathur 30,296 Reputation points Microsoft Employee Moderator

2022-11-04T04:23:28.377+00:00

Hi @Jarod Kurland ,

Just checking in to see if the below answer helped. If this answers your query, please don’t forget to click "Accept the answer" and Up-Vote for the same, which might be beneficial to other community members reading this thread. And, if you have any further query do let us know.

Thanks,
Shweta
Shweta Mathur 30,296 Reputation points Microsoft Employee Moderator

2022-11-14T06:16:16.19+00:00

Hi @Jarod Kurland ,

Just checking in to see if the below answer helped. If this answers your query, please don’t forget to click "Accept the answer" and Up-Vote for the same, which might be beneficial to other community members reading this thread. And, if you have any further query do let us know.

Thanks,
Shweta

Answer 1

Shweta Mathur 30,296 Microsoft Employee Moderator

Hi @Jarod Kurland ,

Thanks for reaching out.

This can be achieved using multi-tenancy. Both the applications need to register as multi-tenant application.

In Tenant A - Create an app registration as multi-tenant application in tenant A (eg: TenantA) and expose it as an API (api://app-id) and add the app roles in the application.

In Tenant B - Create an app registration as multi-tenant application in tenant B and note the client-id of the application.

The client id of application in Tenant B need to be added in known client application in the manifest of application registered in tenant A.

and need to consent application and permission in Tenant B to create the service principal using https://login.microsoftonline.com/common/adminconsent?client_id=<clientIdOfTenantA>&redirect_uri=<redirectURIOfTenantA>

In Tenant B, service principal of Tenant A has been created under Enterprise applications as:

Now tenant A is available in Tenant B. You can go ahead and make the API exposed in tenant A to the tenant B.

Hope this will help.

Thanks,
Shweta

----------------------------------------

Please remember to "Accept Answer" if answer helped you.

Jarod Kurland 146 Reputation points

2022-11-10T07:01:51.313+00:00

Hey @Shweta Mathur !

I've started following this guide and unfortunately got stuck at step 3.
The application in Tenant A of your example can't be multitenant, as I want it to be single tenanted (as it is an internal/private company application).

I think because of this, I get the following error on step 3 when I copy the client Id of the multi-tenant application in Tenant B to the knownClientApplications field in the Manifest of my app on Tenant A:]1

Do you have any further advice for my scenario?
Shweta Mathur 30,296 Reputation points Microsoft Employee Moderator

2022-11-10T09:39:35.603+00:00

Two different tenants can communicate and authenticate each other by defining applications as multi-tenant only so applications are available in other tenants along with their home tenants.

Thanks,
Shweta
Jarod Kurland 146 Reputation points

2022-11-10T10:56:05.897+00:00

Ok great :) with regards to the redirectUri in that consent link (https://login.microsoftonline.com/common/adminconsent?client_id=<clientIdOfTenantA>&redirect_uri=<redirectURIOfTenantA>;) - where do I find this?
Shweta Mathur 30,296 Reputation points Microsoft Employee Moderator

2022-11-10T16:52:59.23+00:00

You can add the redirect URI in tenant A while registering the application under authentication.

If you haven't added that while registering the application, you can add now as well. This can be any URL where response of consent will return.

Thanks,
Shweta
Jarod Kurland 146 Reputation points

2022-11-14T11:47:37.607+00:00

I think I'll accept this and open up a new question for the issue I'm currently facing, since it's more relating to the way I've implemented the auth in my code. Thanks again
Jarod Kurland 146 Reputation points

2022-11-14T12:24:22.063+00:00

I've posted a followup question here:

https://stackoverflow.com/questions/74431422/auth-setup-of-b2c-web-api-accessing-confidential-client-multitenant-web-api
Jaliya Udagedara 2,836 Reputation points MVP Volunteer Moderator

2023-11-01T03:50:14.65+00:00

In my scenario, the Service Principle wasn't created automatically.

So I had to manually add it,
Connect-AzureAD -TenantId '<TenantId>'

New-AzureADServicePrincipal -AppId '<Application (client) ID>'

Share via

Authentication & communication between backend applications on different Azure tenants

0 additional answers

Your answer