Microsoft 365 Community Transform SharePoint Add-in model solutions to modern development patterns, 30 Mar 2023

Previous Meeting

Next Meeting

⏯

youtube image

►

From YouTube: Building multi-tenant solutions which are used by SharePoint Framework solutions

Description

This module introduces you to the development of multi-tenant solutions for SharePoint Online and Microsoft 365. In particular, you will see how to consume multi-tenant applications in SharePoint Framework.

This video is part of a series in a playlist about "Transform SharePoint Add-in model solutions to modern development pattern": https://www.youtube.com/playlist?list=PLR9nK3mnD-OXJLA29Q0Xk7psbAUqzQZwe

➡️ Next video on this series - https://www.youtube.com/watch?v=_z-q787tGrQ&list=PLR9nK3mnD-OXJLA29Q0Xk7psbAUqzQZwe&index=17
⬅️ Previous video on this series - https://www.youtube.com/watch?v=Y8-YSuSKjZA&list=PLR9nK3mnD-OXJLA29Q0Xk7psbAUqzQZwe&index=15

#Microsoft365 #AzureAD #MultiTenant #ISV #SharePointFramework #SharePointOnline

In this video, you will learn about

- Designing multi-tenant solutions for Microsoft 365
- Configuring multi-tenant applications in Azure Active Directory
- Registering and granting permissions to multi-tenant applications

📖 All guidance content including code samples can be found here: http://aka.ms/sp/add-in/modernize/samples

✨ Presenter
• Paolo Pialorsi (PiaSys.com)

📃 Agenda
0:00 Introduction
1:45 Demo
3:04 Configuring application permissions
5:07 Registration and permission grant on tenants
9:00 Using multi-tenant applications in SharePoint Framework

📝 Learn more
• YouTube playlist for this video series - https://www.youtube.com/playlist?list=PLR9nK3mnD-OXJLA29Q0Xk7psbAUqzQZwe
• Tenancies and deployment scopes for SharePoint Add-ins - https://learn.microsoft.com/en-us/sharepoint/dev/sp-add-ins/tenancies-and-deployment-scopes-for-sharepoint-add-ins
• Consent experience for applications in Azure Active Directory - https://learn.microsoft.com/en-us/azure/active-directory/develop/application-consent-experience
• Microsoft identity platform and OAuth 2.0 authorization code flow - https://learn.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-auth-code-flow
• Connect to Azure AD-secured APIs in SharePoint Framework solutions - https://learn.microsoft.com/en-us/sharepoint/dev/spfx/use-aadhttpclient
• Consume multi-tenant enterprise APIs secured with Azure AD in SharePoint Framework - https://learn.microsoft.com/en-us/sharepoint/dev/spfx/use-aadhttpclient-enterpriseapi-multitenant
• Building ISV offering for Microsoft Viva with SPFx ACEs and multi-tenant APIs hosted in Azure - https://www.youtube.com/watch?v=6VEYD11m0TA
• Consume a multi-tenant API within a set of Microsoft Viva Connections Adaptive Card Extensions (ACEs) - https://github.com/pnp/spfx-reference-scenarios/tree/main/samples/ace-pnp-contoso-orders

💡 Learn more about the Microsoft 365 & Power Platform community
• Microsoft 365 Unified Sample gallery - https://aka.ms/community/samples
• Microsoft 365 & Power Platform Community in YouTube - https://aka.ms/community/videos
• Microsoft 365 & Power Platform - http://aka.ms/community/home

Sharing is caring! You are awesome! 🧡

A

A

Hi there and welcome to this video about building a multi-tenant solutions for SharePoint online. Why would you care about building multi-tenant applications first of all?

A

Well, because you might be an ISB willing to create a solution that you want to sell to multiple customers, or maybe you are a developer working in an Enterprise company which is based on multiple tenants for multi-regions needs or maybe because you want to have a centralized deployment and maintenance of your Solutions regardless, if you are in ISB or a developer working in a big Enterprise company, whenever you want to do that, you simply need to register an application in Azure active directory and to choose to make it multi-tenant, meaning that you will select to allow authentication of users from multiple tenants.

A

When you do that, then you can configure the permissions that you need for your application and in every single tenant. Where you want to use your application, you will have to register the application in the tenant and Grant those permissions in the Target tenant. The process is quite straightforward, but not always that easy.

A

That's why, with SharePoint framework, if you are creating an spfx, multi-denant solution, your life can be easier because the SP effects, manifest of any solution, allows you to easily configure all of the needed settings to have a better experience for developers and administrators when registering a multi-tenant solution. So let me move to the new environment, and let me show you what I'm talking about so, let's start registering a multi-tenant application in Azure active directory here, I am in the app registration sections of my target.

A

Tenant I can simply click on new registration, providing a email which can be sample multi-tenant up and right here in the supported account types rather than using the default accounts in the organizational directory. Only I can choose to use accounts in any organizational directory, meaning that the application will be multi-tenant and eventually, if you want to support, also the Microsoft accounts, you can select the third option.

A

So let me click on the register button and the result of this registration step will be that we will have an application in Azure ID with the client ID, which you should keep track of for further use.

A

The tenant ID and if you click on the end, points button right here, you can see that all of the URLs for the open authorization flow as well as for any other security protocol you want to use, are related to the organizations name rather than on a specific tenant name, meaning that this application will Target any organization and not only a specific Target tenant. Then, when you configure the permissions for your application, like, for example, right now, we have the user.read for delegated tokens.

A

We can add additional permissions for micrograph, for example, delegated permission again, and you want to configure the mail send permission and by selecting it you can add the delegated permission to the app. Whenever you will share this application registration with other tenants, users will have to Grant the mail, send and user.3 delegated permissions in their tenant, and, as you can see right here, we have the admin constant required, meaning that right now with the no value, these two permissions do not require internet admin to do the actual Grant of the permission.

A

On the contrary, if we add, for example, a delegated permission for sites dot, something like I don't know full control, full control requires, as you can see from this. Yes, admin consent. So if you will add this permission to the application in your own tenant, you will have as a tenant admin to Grant the permission as well as in any entertainment. Well, you will register the multi-tenant application. You will need an admin Grant now I already have an application that I registered, which is this one. The idea transformation multi-tenant one with this specific client ID.

A

It is a multi-tenant one, as you can see right here, and we can also see that it is a multi-tenant if we go in the authentication section- and we see that right here, we authenticate accounts in any organizational directory. It has been configured with a couple of return, URLs like the PMP GitHub and another one, and we have a bunch of permissions configured like the mail send and user.trip.all, which requires admin consent. Now, let's say that I want to register this application on any other tenant and just for the sake of making an example.

A

I will Target a new tenant that I have in my environment. So in order to register this application, we will need to rely on a URL like the following one, so https login.microatonline.com, the tenant, ID or organizations, is if we are targeting a multi-tenant scenario, which is the version of open authorization authorized, and we have to provide the client ID of the application that we want to register the flavor of response that we want to have.

A

We want to have an authorization code right now, the redirect URI, where we want to redact the user after the registration and the authorization and then the response mode, which will be query, meaning that we want to get back the authorization code in the query string of the response, and we want to get an authorization code for a specific scope of permission, scope that we want to have so, for example, area URL could be this one organization, because we are in a multi-tenant scenario.

A

This is the client ID of the application that we have in Azure active directory. So precisely this one, as you can see, this is the client ID I'm targeting. Then we want to have a an authorization code. We want to redirect the user right here the query string as before- and this will be the permission scope that we want to have granted. So let me copy this URL and let me go to a fresh tenant where I don't have this application registered.

A

So let me copy this URL and, as you will see, Azure act directory will prompt my user to Grant the permissions to the app so the read all user profile and the send mail as you as you can see, I'm right now, using an admin account in the Target tenant. So I can consent on behalf of the organization, these permissions to the application, meaning that all of the user will then find this application registered and they will not need to do any additional Grant.

A

The scenario where we are doing this process using an account which is not an admin account if the permissions are all permission that do not require a tenant admin consent. Then the users will be able to grant for themselves the permission. If the permissions requested by the application include any of the permissions that require the tenant admin consent, then they will not be able to Grant enter the permission, and they will need to ask in that minute and an admin to do the actual, Grant and registration.

A

So now, I'm a tenant admin and I can do that notice. Also, these unverified link right here. If you want to have applications that you want to provide as an isv to multiple customers, you should register as a Microsoft partner, and you should make your application verified and in the reference content of this video and the article related to this video, you can find additional details about how to do that. So now, I will click on a set.

A

My application would be registered and now I've got redirected to the redirection URL that I provided in the grant URL notice that I have electricity and authorization code. That I can then use to get an access token to consume micrograph through the application that I've just registered.

A

So this is the flow from an admin point of view and from a developer point of view, in order to register an application and then Grant access to the application to an entertainment and in fact, if now we go to partner.asure.com right here, portal.asu.com we go into the Azure active directory of this tenant and we go to the Enterprise applications. We can see that right here we have the add-in transformation, multi-tenant application that we have just registered. We can recognize the application ID.

A

We can have a look at the permissions and so on so forth, so we can see what we granted permissions to and eventually, if we want to get rid of it, we can go to properties and we can delete the application registered in our Target payment.

A

Now, let's say that we want to use such kind of application in a SharePoint framework solution, so here, for example, I have a SharePoint framework solution that I have created in order to consume a back-end API through an Adaptive card extension for Microsoft Viva connections.

A

I will not dig into the details of this application, but I will simply tell you that in the package solution.json file of this SharePoint framework solution, I declare that, from a web API permission, requests I want to have access to this application, which will need to have the orders.fully control permission, scope granted for SharePoint framework in order to consume this resource, which is a custom API that I have and I'm specifying the client ID and the reply URL that I want to use for the actual Grant flow.

A

This application. If we go to the Azure active directory where it has been registered- and let me show you this- is the application in the Target Azure directory where it was registered. This is an application which is configured as a multi-tenant application, as you can see from here, or also from the endpoint.

A

Like always, and in this application we have the API permissions to read the user with the delegated access token, but we also expose an API with a couple of permissions which are custom, permissions, PMP controls, orders, slash, orders for control and slash orders, dot read in order to consume this API from SharePoint framework, as I showed you before.

A

I declare that I want for this resource to have the orders.fully control permission, but whenever I will use this application on any fresh new tenant where the application is not registered, we will have first of all to register the application in the Target tenant. In order to do that with SharePoint framework, you can add these two additional attributes, the app ID- and this is the client ID of the application we are targeting.

A

So this one and we have the reply URL, which has to be one of the reply- URLs configured in the authentication section of the application, so that in Visual Studio code with SharePoint framework, you can create an HP packaging package for your solution and you can upload it to a Target app catalog.

A

So let me do that and let me show you the app catalog in a Target thing and where I want to install this application. So let me click on upload and let me select the sppkg file of my solution by doing that, the solution will be uploaded in the app catalog. I will be able to enable this app for the whole tenant by clicking on enable up, and as you can see right here, we see that this application is requesting to have the orders.fully control permission for the pmp.contoso.orders application.

A

However, this application is not yet registered in my target payment, so let's click on the enable up button.

A

Now the application has been enabled, but we still need to go to the API access page to Grant the requested permissions to the application. Let's click on it right here. We see that we have the pmp.contoso.torder resource with the pending permission of type orders full control. If I select this item and I click on approve I can approve this permission request.

A

But in order to do the permission request, first of all, I will have to Grant the application. The requested permissions for micrograph on my target, tenant and I will have to register the application in my target tenant. So as a tenant, admin I can click on this concept on behalf of your organization, I can click accept.

A

The application will be registered on my tenant and I will be redirected to the direction URL provided in the application configuration in the package solution.json file and now I will be able to Grant the permission, and in fact we can see right here that the approved requests includes the permission orders.fullcontrol for the PMP contoso orders and if I go to the Azure active directory of my target, tenant and I go to the Enterprise applications.

A

I can see that right here, I have the PMP Dot contoso dot, orders application that got registered in my target, tenant so being able to use the configuration in the package solution.json file to automatically register and Grant. The permission in my target tenant really improves the quality of life of people installing your SharePoint framework Solutions in a multi-tenant scenario.

A

Here you can find additional links if you want to dig more into the topic covered and like always thank you for watching this video foreign.