Microsoft 365 Community Transform SharePoint Add-in model solutions to modern development patterns, 30 Mar 2023

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Upgrading SharePoint apps from Azure Access Control service to Azure Active Directory

Description

This module introduces you to the migration from Azure Access Control Service (ACS) applications to Azure Active Directory (AAD) applications.

This video is part of a series in a playlist about "Transform SharePoint Add-in model solutions to modern development pattern": https://www.youtube.com/playlist?list=PLR9nK3mnD-OXJLA29Q0Xk7psbAUqzQZwe

➡️ Next video on this series - https://www.youtube.com/watch?v=94eJAsAm1Kg&list=PLR9nK3mnD-OXJLA29Q0Xk7psbAUqzQZwe&index=10
⬅️ Previous video on this series - https://www.youtube.com/watch?v=3u1ei8hcGG8&list=PLR9nK3mnD-OXJLA29Q0Xk7psbAUqzQZwe&index=8

#Microsoft365 #AzureAD #AzureACS #SharePointOnline

In this video, you will learn about

- Understanding Azure Active Directory registered applications
- Upgrading from ACS to AAD
- Consuming SharePoint Online with application only

📖 All guidance content including code samples can be found here: http://aka.ms/sp/add-in/modernize/samples

✨ Presenter
• Paolo Pialorsi (PiaSys.com)

📃 Agenda
0:00 Introduction
2:00 How to upgrade from ACS to AAD
2:47 Demo
6:13 Registering an AAD application for application only
9:32 AAD registered app permissions

📝 Learn more
• YouTube playlist for this video series - https://www.youtube.com/playlist?list=PLR9nK3mnD-OXJLA29Q0Xk7psbAUqzQZwe
• Accessing SharePoint using an application context, also known as app-only - https://docs.microsoft.com/en-us/sharepoint/dev/solution-guidance/security-apponly
• Granting access using SharePoint App-Only - https://docs.microsoft.com/en-us/sharepoint/dev/solution-guidance/security-apponly-azureacs
• Granting access via Azure AD App-Only - https://docs.microsoft.com/en-us/sharepoint/dev/solution-guidance/security-apponly-azuread
• PnP PowerShell - https://pnp.github.io/powershell/
• PnP Core SDK - https://pnp.github.io/pnpcore/
• PnP Framework documentation - https://pnp.github.io/pnpframework/

💡 Learn more about the Microsoft 365 & Power Platform community
• Microsoft 365 Unified Sample gallery - https://aka.ms/community/samples
• Microsoft 365 & Power Platform Community in YouTube - https://aka.ms/community/videos
• Microsoft 365 & Power Platform - http://aka.ms/community/home

Sharing is caring! You are awesome! 🧡

A

A

Access control services to Azure active directory registered applications. The use case for this scenario is when you want to create a demo or a background application which will interact with elevated permissions with SharePoint online, and you will not use any specific user account, but you want to use an application, only account the options available nowadays to realize this kind of scenario are using a major access control services registered application in a specific Target tenant or an Azure active directory registered application.

A

So let me try to explain you why you should use Azure directory, and in case you have an access, control services register application. You should upgrade it to Azure ID. First of all, Azure access control services is now what there is an old service based on an old development model, in fact Microsoft retired ECS in November 2018.. It is still available for SharePoint online, but you should not use it anymore in new Solutions and you should upgrade your existing solutions to the new model, which is the one based on Azure active directory.

A

Moreover, the Azure ACS is a model, is an authentication model for application, which is based on the Adin model of SharePoint, which is now kind of an old model, and nowadays you should rely on new modern development techniques and again, one more time on Azure active directory application registration where, for example, you can also leverage the resource, specific content or decide.selected permissions which allow you to have a really granular selection of permissions whenever you need to consume a SharePoint online site or content. So how can you actually upgrade from ACS to AED?

A

Well, first of all, you need to reduce history. New Azure, active directory application. You need to create an x519 certificate for the authentication. In fact, SharePoint online for app only requires you to authenticate providing an x509 certificate.

A

You have to configure the API permissions that you will need with your application in order to consume SharePoint online, and then you will need to refactor a bit your code in order to move from the old school client, ID and client secret and ACS to the new school of azure, active directory, open authorization and a client ID with a certificate. So let me move to the demo environment and let me show you how you can do that in practice.

A

So imagine that we have an application that we already registered in Azure ACS.

A

The registration goes through the upright new page of your target, SharePoint online tenant, and you will get back a client, ID, a client secret, and you have to provide the title, an app domain and then a direct URI for your application once you've done that you can retrieve, through the app inventory up in dot, SPX page under digital point admin, UI your application, doing a lookup by client ID, and you will be able to configure a custom set of permissions like you can see here right here when we provide an application permission of type full control to this application, meaning that it will have access to all of the site collections in maintenance with full control rides.

A

And then we have a side collection. This one from ACS 3ad apps, in which I have a document Library the default. One and I want to write an application to read the title of this document library and to upload the document into the document Library. So we can do that using a c-sharp application. For example, here I have an application in which I'm using some packagings, like the PMP framework, for example, to speed up the development process consuming SharePoint online and I'm, using some other packages to manage the configuration setting of my application.

A

In fact, my settings I will have this URL of the site that I want to consume the title of the list or library that I want to consume the client ID and the client secret of my application.

A

As such, when I will execute my application, which is about net 6 application, I will need to read the configuration from the app settings. Json file I will translate the Json settings into a fully type object and then using a PMP framework. I can create an authentication manager instance and I can do the get ACS upon the context. The providing URL of the target side, the client ID and the client secret I will get back a client context.

A

Object of system of decline, side of the model of SharePoint online and then using season I can get a list by title. Providing the title of my list. I can do the load of the list, including the title so that by executing the query, asynchronously against the SharePoint online I will get back.

A

The title of my list: I can create a random file content with random text inside of it and I can upload the file again as synchronously in the root folder of my target Library, simply specifying a random file name based on a guide and that's it. So this is a very simple example that we want to upgrade from ACS to Azure ID.

A

So if I will run this application, even if it is a very simple one, we can see that in a matter of few seconds we will have our console application running and we will get back the title of the target document. Library and the document will be created in the Target document library. In fact, if I refresh this Library, we can see that now we have a new file that I just created simple. As that now, let's make the assumption that we want to upgrade the solution to Azure active directory.

A

We can easily register a new application in Azure ID, simply relying on PMP power. Shell and specifically, we can use the register PMP Azure ID app command letter providing the application name, which will be the name of the application that will be registered in Azure ID. We can provide this store where we want to save generated risk 509 certificate which will be created by the CMD LED and uploaded to Azure, active directory and Associated to our application in nature.

A

Active directory with have to specify the target tenant, as you can see right here, as well as the username and the password to access the target 10 and register the application and the password will be provided through a prompt to the user as well as we can specify a certificate password which will be used to protect the private key on the certificate and again here, I'm, using a prompt for the user and now I'm going to say the dot serum.pfx files Associated to the auto generated file of my certificate into the current part.

A

So, by executing this CMD layer we will have to provide first of all the credentials of the user that want to use to register my application and then I will have to provide a password which should be strong enough, secure enough to protect the private key of my certificate, the CMD. Let will start creating the certificate and storing the certificate in the certificate store.

A

Then it will create the application initial active directory and will wait up to 60 seconds for the app to be ready, and then it will launch the web UI to Grant the permissions that will be automatically granted by the CMD led to the application created. I, don't want to waste your time, so I will speed up the recording while waiting for the 60 seconds, and here we are now we will have a web prompt to Grant the permissions to our newly registered application.

A

First of all, we need to pick a user account to use in order to do the grant of the permissions and we will have to provide a password for that users and once we have done that, we will be able to Grant the permissions automatically added to the application registrations by the CMB LED.

A

If you like, using additional Arguments for the CMD letter, you can choose the permission that you want to Grant targeting either SharePoint online permissions or micrograph permissions right now, I'm using default permissions I'm accepting to Grant those permissions to my app and in a matter of few seconds now we're ready. The page is done, don't care about this kind of response, but now the application is registered and in fact, if I will go to Azure active directory, we can see that we have. My application.

A

Registered I can click on it and we can see yet we have an application with a specific client, ID and directory ID. We can click on the certificate and secret to see the certificate that has been generated automatically by the CMD. Let and if we go to API permissions, we can see the permissions granted to the application, as you can see right here. So it is now time to consume one more time: SharePoint online, the same side collection as before, but now using the Azure ID registered application. The application is almost the same as before.

A

We still have an app settings.json file where we specify still the site URL the list ID the client ID and this time the tenant ID and the certificate thumb print which we can get back from the certificate that was generated. Then, instead of using an instance of authentication manager to create the client context based on the ACs credentials. We rather read the certificate that we want to use to authenticate against Azure active directory, providing the Target store, the store location and the thumbprint of the certificate which we can read from the settings of our application.

A

And then we create a new instance of the authentication manager using this Factory method, which is create with certificate which will accept the client ID the certificate and the Tenant ID. By doing that, the authentication manager will allow us to invoke the get context method to still get a client context of season, and since we have a client constant, we can then do exactly what we did before in the previous sample and we can read the title of the document library and we can upload a document into the target document Library.

A

So at the very end, we simply need to register the application image ready. You can do that using the PNP power shares emulator or you can do it manually, as you can read through the article Associated to this video and once you have got the application registered and the certificate created for you, you can authenticate using the authentication manager providing that certificate, the client ID and the Tenant ID. You get the context and you are good to go. That's the replacement. You need to do to upgrade your solution. Just for the sake of completeness.

A

Let me run this application as like, as I did with the previous one. So now we have yet another console application running. We get the title of the library and we just uploaded a new document in the Target library. In fact, if we go back here and we refresh now, we have two documents. Instead of one and the last one was created few seconds ago here, you can find additional links. If you want to dig into this topic and thanks for watching this video.