Azure Applicatiom Registration (multi-tenants)

Question

Hello everyone, I have a question for you.
if I have 3 different SharePoint tenants (prod-uat-dev), I would like to configure only 1 azure app registration to access some data in all 3 tenants ( I will be using some graph and spo apis). The app registration should be made on the prod environment. Can someone tell me how to do this configuration? and if I have to create 3 different app registrations for each tenant.

Answer 1

Hi @Michel AL HAYEK , thanks for reaching us.

I understand you want to configure a single Azure App Registration to access data in three different SharePoint tenants (prod-uat-dev) using Graph and SPO APIs. The App Registration should be created in the prod environment.

You do not need to create three different app registrations for each tenant. One app registration can work across multiple tenants if you follow the below steps.

1.Navigate to the Azure portal and select the Azure Active Directory service.

2.Select the App Registrations blade on the left, then select new registration.

a. In the Name section, enter a meaningful application name that will be displayed to users of the app.

b. Under Supported account types, select Accounts in any organizational directory.

c. Click on Register to create the application.

3.Select the Authentication blade to the left. Click on Add a platform and configure platforms, enter Redirect URI. click on configure to save your changes.

4.Select the API permissions blade in the left to open the page where we add access to the APIs that your application needs.

a.Delegated permissions, which is required by apps signing-in users.
Add a permission -> Microsoft API's -> select Microsoft Graph -> Delegated permissions -> select User.Read.All in the list -> click to Add Permission.

b. Grant permission to share point.
Add a permission -> Microsoft API's -> Select SharePoint -> Application permissions ->Sites -> Sites.FullControl.All -> Add permission.

5.Select the Certificates & secrets blade in the left to open the page where you can generate secrets and upload certificates.

6.Configure web Application to use your app registration.

7.Test the App Registration to ensure that it can access data in all three tenants.

For your reference https://github.com/Azure-Samples/active-directory-aspnetcore-webapp-openidconnect-v2/blob/master/2-WebApp-graph-user/2-3-Multi-Tenant/README.md

If you have already created a single tenant, you can convert a single tenant app into a Microsoft Entra multi-tenant app.

Refer Making your application multi-tenant.

Hope this helps. Do let us know if you any further queries.

Thanks,
Navya.

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.