Granting Access to External Tenants

Question

I have created an application that uses the Microsoft Graph API to access files inside my companies One Drive or SharePoint Sites. I registered an app with the Azure Active Directory and have configured application level permissions because my app has no UI or a redirect URI. The app works as expected with my tenant ID but how do I allow other tenants or companies to use my app with their One Drives and Sites?

I want to allow other external tenants to use my application to access their own sites and drives.

I am using this endpoint:
https://login.microsoftonline.com/{tenant-id}/oauth2/v2.0/token

with these headers:

client_id, scope, client_secret, grant_type

to get an access token.

Is it as simple as having another company use their tenant-id or will they have to grant permissions by login in somewhere?

Answer 1

Hi @Joseph Wylie

If you want other tenants to be able to access your app, you must configure your app as a multi-tenant app.

Find your app and change its supported account types to the following:

Next, you need to run the administrator consent URL in the browser and log in with the administrator of the target tenant and consent. After that, your multi-tenant app will be added to the target tenant as an enterprise app.

https://login.microsoftonline.com/{id of the target tenant}/adminconsent?client_id={client id}

Finally you need to change /{tenant-id} to the id of the target tenant to get an access token for the target tenant.

https://login.microsoftonline.com/{id of the target tenant}/oauth2/v2.0/token

Hope this helps.

If the reply is helpful, please click Accept Answer and kindly upvote it. If you have additional questions about this answer, please click Comment.