Let's say I have SharePoint Online subscription, hence I can manage own *.onmicrosoft.com domain and users/groups connected with it.
As far as I understand, the storage behind SPO where users and groups reside is an Azure AD.
I had a thought that the only way to manage these users/groups remotely is using PowerShell module for Microsoft Online. And now I wounder whether Azure Graph API can be used for purposes of retrieving users and group members from the SPO? I have no Azure subscription, is there a way to utilize Azure Graph API without Azure subscription, having only SPO subscription?
Ok, turns out it is possible. Briefly steps are the following:
Create a service principal that will serve as 'contact point' with your external application (here is a good start point); I've used symmetric key authorization;
Add a newly created service principal to the 'Company Administrator' role;
Look at the azurecoder's article and check out his comprehensive example of using Graph API: https://github.com/azurecoder/azure-activedirectory; this code correctly deals with authentication parameters, like constructing proper service realm.
After that I was able to grab users, groups and users membership information for SPO instance without creating a Azure AD subscription.
Related
When creating ASP.NET Core web app, if you use Azure AD for authentication, is it possible to store user info in your app database? And if so, is there a best practice approach to doing this?
I'd like to store user role info in my app's database; I know you can use AD groups but
(a) I'd like to be able control this from within the app and
(b) I don't know if I have permissions to create new groups in my company's Azure AD.
yes, you can. After authentication with Azure AD, you can get userinfo from ID token if you are using OIDC. Then you can store the userinfo in your app's local database.
For (a), you wanna control user role in your app which used to edit in azure portal. Then you may take microsoft graph api user role into consideration. You may check the link if this api is what you need.
(b) create new groups, this can achieved by this api.
Calling microsoft graph api required an azure ad application which can be assigned api permission by admin, then it can be used to generate access token to call the api.
Import Bulk users from Azure Active Directory to SQL database using ASP.NET MVC.
If a new user added means, it should reflect in SQL database also.
You can use SCIM, an open standard for this scenario. This is taken from the microsoft docs that describes using SCIM with Azure AD
As an application developer, you can use the System for Cross-Domain Identity Management (SCIM) user management API to enable automatic provisioning of users and groups between your application and Azure AD. This article describes how to build a SCIM endpoint and integrate with the Azure AD provisioning service. The SCIM specification provides a common user schema for provisioning. When used in conjunction with federation standards like SAML or OpenID Connect, SCIM gives administrators an end-to-end, standards-based solution for access management.
(source)
Basically you have to implement some well defined endpoints in your MVC app and Azure AD will take care of the syncing (it will call those endpoints).In your implementation you can access your database to store the user data.
Here is a reference implementation using an in memory datastore.
I have a SharePoint Online application that access an API the reside outside my network and one of our Azure. This API is accessibly through public. I am using this API to access data in my SQL server, with this I am worried that my API is not secure and I am wonder what are the things I can do to secure my API so that no only users logged in to our SharePoint can use it.
There are several ways in which you can secure it. These ways vary in complexity and each have their specific considerations.
Secure an API with Azure AD
If you're using Office 365, securing custom APIs using Azure AD is an architectural option that you should definitely consider. First and foremost, it allows you to secure the access to the API using existing organizational credentials that are already managed through Office 365 and Azure AD. Users with an active account can seamlessly work with applications that leverage APIs secured with Azure AD. Azure AD administrators can centrally manage access to the API, the same way they manage access to all other applications registered with Azure AD.
More info: here
I have a desktop application which I want to create a new service account for each user of my application.
Is there any API for creating the service account users on the fly?
Scenario: For each user, I want to give service account, and give this service account the data that this user needs.
The point is that I want to give every user some specific data from Google Cloud, but I want the user to get it directly from Google. I cannot use the user account, because I am not sure he have google account.
You can use the Google Identity and Access Management (IAM) API to programatically create service accounts.
However, creating a service account for each of your application's users is expensive and not scalable. Perhaps your service can have a single service account and then the service can control which of the resources that the user may access.
There is no Google Api that allows you to control projects on Google Developer console. The only thing that comes close is the Google Cloud Resource Manager API which is extremely limited in what it supports. You cant use it to create a service account.
Answer: The only way to create a new service account is to log in and do it though the Google Developers console.
We are looking to host our product on Azure- the intent behind using Azure is that we get to focus on the core product, and are fine with the standard cloud features that Azure offers without needing to understand too much of the internals- not exactly the power users!
One thought was that if Azure had an authentication functionality- profiles, logins, password reset/ reminder etc, it would save us time from building what is essentially a commodity
Any guidance on this?
Azure offers the Access Control Service, which is a Federated Authentication service. It's already preconfigured with support for Live ID, Google and Yahoo authentication, but you can also add your own security token service (such as ADFS).
Windows Azure does not have a built in login feature. However,App Fabric Access Control Service(ACS) does; see the ACS tutorial here for example usage.