How to create instance of our multi-tenant AAD daemon application on client's active directory (on-premises AD)?

Question

How to create instance of our multi-tenant AAD daemon application on client's active directory (on-premises AD)?

Asif Ansari 1

We have a multi-tenant daemon application that connects (using client credentials) with the client outlook to perform some operations.
We have successfully integrated with the clients on Azure AD.

We have certain clients using an on-premises active directory. I need to integrate this application with an on-premises active directory of the client.
Can someone please guide me with the steps to follow to perform integration?

Asif Ansari 1 Reputation point

2022-08-29T15:50:05.26+00:00

@AmanpreetSingh-MSFT Could you please guide us? Can client on Local Active Directory provision our multi-tenant application?

1 answer

Your answer

Asif Ansari 1 Reputation point

2022-08-29T15:50:05.26+00:00

@AmanpreetSingh-MSFT Could you please guide us? Can client on Local Active Directory provision our multi-tenant application?

Answer 1

AmanpreetSingh-MSFT 56,866 Moderator

Hi @Asif Ansari • Thank you for reaching out.

As per the design, this is not possible.

When a multi-tenant application registered in an Azure AD tenant (tenant1) is accessed via a user/admin in another tenant (tenant2), they are required to consent as part of the OAuth standard. Once the consent is granted, a service principal with the same AppID and different objectID gets created in that tenant. The tenant2 can then issue a JWT token to the application as the audience.

This process cannot be done in case of On-premises AD. The best possible option that you have as of now is to configure native client applications to interact with proxy applications as documented here: https://learn.microsoft.com/en-us/azure/active-directory/app-proxy/application-proxy-configure-native-client-application

-----------------------------------------------------------------------------------------------------------

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

Asif Ansari 1 Reputation point

2022-08-30T08:00:50.993+00:00

Thank you for the quick response.

Is user sign-in mandatory for native applications?
Since we are looking for approaches that don't require user sign-in due to the nature of our daemon application (scheduler app). Hence we adopted the client credentials flow.

Does the native application have any other flows that don't require user sign-in?
What other approaches (other than native) can we adopt that don't require user sign-in?
AmanpreetSingh-MSFT 56,866 Reputation points Moderator

2022-08-30T16:16:24.317+00:00

@Asif Ansari • With app proxy, you can use client credentials flow to access a protected API as mentioned below:

You can then use the token as bearer to call backend API via your Native App.
Asif Ansari 1 Reputation point

2022-09-01T06:10:16.147+00:00

Ok great and since we are using graph API to access the client mailbox, how will the permission be granted by the client?

Share via

How to create instance of our multi-tenant AAD daemon application on client's active directory (on-premises AD)?

1 answer

Your answer