.netazuremulti-tenantmicrosoft-graph-apiadal

How can I use my Azure AD app from another tenant?

I am developing a native app that has to display the Office 365 groups the user is a member of. For this, I call the Microsoft Graph API which requires authentication. I'm using the ADAL library.

The permissions needed require admin consent. Everything works fine for users from my tenant, but when I try to authenticate with an account of another tenant it doesn't work. It keeps giving this result:

Correlation ID: 9780ed24-9d24-4604-b8bf-28a02c2ea580

Timestamp: 2017-04-14 12:05:45Z

AADSTS70001: Application with identifier 'xxxxxxxx-xxx-xxx-xxxx-xxxxxxxxxxxx' was not found in the directory XXXXXXX.onmicrosoft.com

even if I use an admin account on first connection. I am never asked for consent and the app is not registered on the other tenant.

The app is registered as Native so it should be multi-tenant and I pass "/common" as the tenant in the authority.

I also tried to register an app with the same specifications on the other tenant, gave admin consent on the permissions and it worked as well.

Here is how I retrieve the access token:

private static string GetAccessToken()
    {
        AuthenticationContext authContext = new AuthenticationContext(authority);

        AuthenticationResult authResult = authContext.AcquireToken(graphResource, clientID, redirectURI, PromptBehavior.RefreshSession);
        var accessToken = authResult.AccessToken;
        return accessToken;
    }

Is it a problem within the code? The parameters? Do the other tenants need some 'special azure subscription' I'm not aware of?

In short: How do I get it to work for other tenants?

Edit: I tried to manually add the "prompt=admin_consent" to the request, like this:

AuthenticationResult authResult = authContext.AcquireToken(graphResource, clientID, redirectURI,PromptBehavior.RefreshSession, UserIdentifier.Any, "prompt=admin_consent");

But it triggers an error saying that there is a "Duplicate query parameter 'prompt' in extraQueryParameters"

Solution

  • This is a known issue in the new Azure portal when registering native client applications.

    These are currently (as of 2017-04-14) being created as single-tenant applications. Since the Azure portal doesn't expose the "multi-tenant" toggle for native client applications, you need to update the app manifest or use Azure AD PowerShell to do this.

    Making an app multi-tenant from the manifest

    1. In the Azure portal, from the settings blade for your native client application, click the Manifest option.

      enter image description here

    2. Update the availableToOtherTenants value to true.

      enter image description here

    3. Save the manifest.

      enter image description here

    Making an app multi-tenant with Azure AD PowerShell

    1. Download the Azure AD PowerShell v2 module (AzureAD): https://learn.microsoft.com/en-us/powershell/azure/install-adv2?view=azureadps-2.0

    2. Run the following:

      $appId = "<app ID>"
$app = Get-AzureADApplication -Filter "appId eq '$appId'"
Set-AzureADApplicatoin -ObjectId $app.ObjectId -AvailableToOtherTenants $true

    That should patch it up. Wait a bit, then try again.