Events
Mar 17, 9 PM - Mar 21, 10 AM
Join the meetup series to build scalable AI solutions based on real-world use cases with fellow developers and experts.
Register nowThis browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
Namespace: microsoft.graph
An API to check validity of the endpoint and and authentication configuration for a customAuthenticationExtension object, which can represent one of the following derived types:
This API is available in the following national cloud deployments.
Global service | US Government L4 | US Government L5 (DOD) | China operated by 21Vianet |
---|---|---|---|
✅ | ✅ | ✅ | ❌ |
Choose the permission or permissions marked as least privileged for this API. Use a higher privileged permission or permissions only if your app requires it. For details about delegated and application permissions, see Permission types. To learn more about these permissions, see the permissions reference.
Permission type | Least privileged permissions | Higher privileged permissions |
---|---|---|
Delegated (work or school account) | CustomAuthenticationExtension.Read.All | CustomAuthenticationExtension.ReadWrite.All |
Delegated (personal Microsoft account) | Not supported. | Not supported. |
Application | CustomAuthenticationExtension.Read.All | CustomAuthenticationExtension.ReadWrite.All |
Important
In delegated scenarios with work or school accounts, the admin must be assigned a supported Microsoft Entra role or a custom role with a supported role permission. The following least privileged roles are supported for this operation:
To validate the endpoint and authentication configuration for a customAuthenticationExtension by its ID.
POST /identity/customAuthenticationExtensions/{customAuthenticationExtensionId}/validateAuthenticationConfiguration
To validate the endpoint and authentication configuration that's specified in the request body for a customAuthenticationExtension. The custom authentication extension object may not exist yet and you can use this endpoint to validate the configuration before creating the custom authentication extension.
POST /identity/customAuthenticationExtensions/validateAuthenticationConfiguration
Name | Description |
---|---|
Authorization | Bearer {token}. Required. Learn more about authentication and authorization. |
In the request body, supply JSON representation of the parameters.
The following table shows the parameters that can be used with this action. Supply a endpointConfiguration and authenticationConfiguration if querying at the root level. Otherwise, for a specific custom extension, do not supply a request body for this method.
Parameter | Type | Description |
---|---|---|
endpointConfiguration | customExtensionEndpointConfiguration | The HTTP endpoint for the custom authentication extension to be validated. |
authenticationConfiguration | customExtensionEndpointConfiguration | The authentication configuration for the custom authenticaion extension to validate. |
If successful, this action returns a 200 OK
response code and a authenticationConfigurationValidation in the response body.
The following example shows a request.
POST https://graph.microsoft.com/v1.0/customAuthenticationExtensions/validateAuthenticationConfiguration
Content-Type: application/json
{
"endpointConfiguration": {
"@odata.type": "#microsoft.graph.httpRequestEndpoint",
"targetUrl": "https://australia.contoso.com/users"
},
"authenticationConfiguration": {
"@odata.type": "#microsoft.graph.azureAdTokenAuthentication",
"resourceId": "api://extensibilityapi.azurwebsites.net/f9c5dc6b-d72b-4226-8ccd-801f7a290428"
}
}
The following example shows the response.
Note: The response object shown here might be shortened for readability.
HTTP/1.1 200 OK
Content-Type: application/json
{
"@odata.context": "https://graph.microsoft.com/v1.0/$metadata#microsoft.graph.authenticationConfigurationValidation",
"errors": [
{
"code": "IncorrectResourceIdFormat",
"message": "ResourceId should be in the format of 'api://{fully qualified domain name}/{appid}'"
},
{
"code": "DomainNameDoesNotMatch",
"message": "The fully qualified domain name in resourceId should match that of the targetUrl"
},
{
"code": "ServicePrincipalNotFound",
"message": "The appId of the resourceId should correspond to a real service principal in the tenant"
}
],
"warnings": [
{
"code": "PermissionNotGrantedToServicePrincipal",
"message": "The permission CustomAuthenticationExtensions.Receive.Payload is not granted to the service principal of the resource app"
},
]
}
The following example shows a request.
POST https://graph.microsoft.com/v1.0/identity/customAuthenticationExtensions/9f39f3bb-457c-4a2a-8099-0e480e7ea142/validateAuthenticationConfiguration
The following example shows the response.
Note: The response object shown here might be shortened for readability.
HTTP/1.1 200 OK
Content-Type: application/json
{
"@odata.context": "https://graph.microsoft.com/v1.0/$metadata#microsoft.graph.authenticationConfigurationValidation",
"errors": [
{
"code": "IncorrectResourceIdFormat",
"message": "ResourceId should be in the format of 'api://{fully qualified domain name}/{appid}'"
},
{
"code": "DomainNameDoesNotMatch",
"message": "The fully qualified domain name in resourceId should match that of the targetUrl"
},
{
"code": "ServicePrincipalNotFound",
"message": "The appId of the resourceId should correspond to a real service principal in the tenant"
}
],
"warnings": [
{
"code": "PermissionNotGrantedToServicePrincipal",
"message": "The permission CustomAuthenticationExtensions.Receive.Payload is not granted to the service principal of the resource app"
},
]
}
Events
Mar 17, 9 PM - Mar 21, 10 AM
Join the meetup series to build scalable AI solutions based on real-world use cases with fellow developers and experts.
Register now