How can you limit which tenant authentication is allowed for with an Azure Static Web App?

Question

We have an Azure static web application that we want to limit access to based on the Azure tenant. Anyone not in the tenant shouldn't be able to access the site. I have followed this guide:

https://anthonychu.ca/post/static-web-apps-restrict-aad-users/

No matter what I try, any valid Microsoft Entra ID login allows access, even if they are not associated with the tenant configured.

Answer 1

Hello @Josh Donner !

I suppose you have selected Standard Plan for your Static Apps right ?

---

I hope this helps!

Kindly mark the answer as Accepted and Upvote in case it helped!

Regards

Answer 2

Has this topic been resolved? I am experiencing the exact same issue.

My staticwebapp.config.json looks like described above. If I use an user of my tenant, I am forwarded to the "company SSO". Thus, I know that TENANT_ID, AZURE_CLIENT_ID, and AZURE_CLIENT_SECRET is used correctly (This is not the case, if I replace e.g. AZURE_CLIENT_SECRET by an incorrect value). However, when logging in to a private user (not in the tenant), Im getting the authenticated rule anyway.

The App Registration is set to "single tenant" and "assignment required" is set to true in the Enterprise Application.

Answer 3

Hi @Josh Donner , you can configure a custom Azure Active Directory (Azure AD) provider. The pre-configured Azure AD provider allows any Microsoft account to sign in, but by configuring a custom Azure AD provider, you can restrict sign-in to a specific Azure AD tenant.

Here's an example of how to configure a custom Azure AD provider in the staticwebapp.config.json file:

{
  "auth": {
    "identityProviders": {
      "azureActiveDirectory": {
        "registration": {
          "openIdIssuer": "https://login.microsoftonline.com/<TENANT_ID>/v2.0",
          "clientIdSettingName": "AZURE_CLIENT_ID",
          "clientSecretSettingName": "AZURE_CLIENT_SECRET"
        }
      }
    }
  }
}

Make sure to replace <TENANT_ID> with your Azure Active Directory tenant ID.

Additionally, ensure that you have created the appropriate application settings for AZURE_CLIENT_ID and AZURE_CLIENT_SECRET.

Please let me know if you have any questions and I can help you further.

If this answer helps you please mark "Accept Answer" so other users can reference it.

Thank you,

James