What are the functional differences between App ID URI and Return URLs in AzureAD app registrations?

Question

What are the functional differences between App ID URI and Return URLs in AzureAD app registrations?

Anne Admin 6

We are encountering an issue with AzureAD where the App ID URI cannot be set to a URL which is not a trusted domain

No such restriction applies to return URLs

Why are the restrictions different between these two functions? My understanding was that they were almost completely interchangeable

1 answer

Your answer

Answer 1

Shweta Mathur 30,296 Microsoft Employee Moderator

Hi @Anne Admin ,

Thanks for reaching out.

I understand you are skeptical about the Application Id URI and Redirect URI which need to register in the portal while Application registration.

The Application ID URI field is used to uniquely identify the scopes of your custom api and hence that entry has to be globally unique. You can either use the default value provided, which is in the form api://<application-client-id> or specify a more readable URI like https://contoso.com/api.

It would always recommend a fresh setup for the app registration, if that is a possibility on your end and set App Id URI which always generates unique App ID URI name in its Azure AD tenant or verified customer owned domain.

Supported application Id formats are mentioned here.

whereas redirect URI, or reply URL, is the location where the authorization server sends the user once the app has been successfully authorized and granted an authorization code or access token. This can be any page and not required to be always unique.

However, there are some restrictions for redirect URL which is mentioned here.

Both the application Id URI and Redirect URL have different functionality and cannot be interchange.

Hope this will help.

Thanks,
Shweta

----------------------------------------

Please remember to "Accept Answer" if answer helped you.

Anne Admin 6 Reputation points

2022-11-07T01:23:33.45+00:00

Thanks that makes sense - the situation we're in is that we have SaaS URLs e.g. https://mycustomer.saas.com which we are asking "mycustomer" to register in their AzureAD App ID URI - but this won't work because they don't have saas.com as a trusted domain

Whats the recommended way to handle these situations?

Is there a way that we can redirect saas.onmicrosoft.com/mycustomer to mycustomer.saas.com perhaps?
Shweta Mathur 30,296 Reputation points Microsoft Employee Moderator

2022-11-07T04:14:15.55+00:00

Hi @Anne Admin ,

No, it is not possible to redirect the Azure AD App ID URI.

App ID URI expose the scopes of your custom api register in Azure AD. Could you please elaborate your scenario what you are trying to achieve.
Does this SaaS URLs have API's scopes which you are looking to expose?

Thanks,
Shweta
Anne Admin 6 Reputation points

2022-11-07T05:11:24.62+00:00

Basically we are providing SaaS to a customer, they have an app registration in their AzureAD tenancy for our app

The SaaS uses our top level domain, e.g https://customer.saas.com

So when they try to add that URI to their App ID uri they get an error because our domain is not trusted by their tenancy, and it can't be trusted because that would let them create AzureAD users in our SaaS tenancy

Share via

What are the functional differences between App ID URI and Return URLs in AzureAD app registrations?

1 answer

Your answer