Skip to content

Commit 0125883

Browse files
terencefanterencefan
authored
update
1 parent 44431d6 commit 0125883

File tree

3 files changed

+42
-18
lines changed

3 files changed

+42
-18
lines changed

‎articles/azure-signalr/includes/signalr-add-role-assignments.md

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ ms.author: tefa
99
ms.custom: include file
1010
---
1111

12-
The following steps describe how to assign a SignalR App Server role to a service principal (application) over an Azure SignalR Service resource. For detailed steps, see [Assign Azure roles using the Azure portal](../role-based-access-control/role-assignments-portal.yml).
12+
The following steps describe how to assign a SignalR App Server role to a service principal over an Azure SignalR Service resource. For detailed steps, see [Assign Azure roles using the Azure portal](/azure/role-based-access-control/role-assignments-portal.yml).
1313

1414
> [!NOTE]
1515
> A role can be assigned to any scope, including management group, subscription, resource group, or single resource. To learn more about scope, see [Understand scope for Azure RBAC](../role-based-access-control/scope-overview.md).
@@ -26,10 +26,10 @@ The following steps describe how to assign a SignalR App Server role to a servic
2626

2727
| Role | Description | Use case |
2828
| ------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------- |
29-
| [SignalR App Server](../role-based-access-control/built-in-roles.md#signalr-app-server) | Access to the server connection creation and key generation APIs. | Most commonly used for app server with Azure SignalR resource run in **Default** mode. |
30-
| [SignalR Service Owner](../role-based-access-control/built-in-roles.md#signalr-service-owner) | Full access to all data-plane APIs, including REST APIs, the server connection creation, and key/token generation APIs. | For negotiation server with Azure SignalR resource run in **Serverless** mode, as it requires both REST API permissions and authentication API permissions. |
31-
| [SignalR REST API Owner](../role-based-access-control/built-in-roles.md#signalr-rest-api-owner) | Full access to data-plane REST APIs. | For using [Azure SignalR Management SDK](/azure/azure-signalr/signalr-howto-use-management-sdk) to manage connections and groups, but does **NOT** make server connections or handle negotiation requests. |
32-
| [SignalR REST API Reader](../role-based-access-control/built-in-roles.md#signalr-rest-api-reader) | Read-only access to data-plane REST APIs. | Use it when write a monitoring tool that calls readonly REST APIs. |
29+
| [SignalR App Server](/azure/role-based-access-control/built-in-roles.md#signalr-app-server) | Access to the server connection creation and key generation APIs. | Most commonly used for app server with Azure SignalR resource run in **Default** mode. |
30+
| [SignalR Service Owner](/azure/role-based-access-control/built-in-roles.md#signalr-service-owner) | Full access to all data-plane APIs, including REST APIs, the server connection creation, and key/token generation APIs. | For negotiation server with Azure SignalR resource run in **Serverless** mode, as it requires both REST API permissions and authentication API permissions. |
31+
| [SignalR REST API Owner](/azure/role-based-access-control/built-in-roles.md#signalr-rest-api-owner) | Full access to data-plane REST APIs. | For using [Azure SignalR Management SDK](/azure/azure-signalr/signalr-howto-use-management-sdk) to manage connections and groups, but does **NOT** make server connections or handle negotiation requests. |
32+
| [SignalR REST API Reader](/azure/role-based-access-control/built-in-roles.md#signalr-rest-api-reader) | Read-only access to data-plane REST APIs. | Use it when write a monitoring tool that calls readonly REST APIs. |
3333

3434

3535
1. On the **Members** tab, select **User, group, or service principal**, and then choose **Select members**.
@@ -43,8 +43,8 @@ The following steps describe how to assign a SignalR App Server role to a servic
4343
4444
To learn more about how to assign and manage Azure roles, see these articles:
4545

46-
- [Assign Azure roles using the Azure portal](../role-based-access-control/role-assignments-portal.yml)
47-
- [Assign Azure roles using the REST API](../role-based-access-control/role-assignments-rest.md)
48-
- [Assign Azure roles using Azure PowerShell](../role-based-access-control/role-assignments-powershell.md)
49-
- [Assign Azure roles using the Azure CLI](../role-based-access-control/role-assignments-cli.md)
50-
- [Assign Azure roles using Azure Resource Manager templates](../role-based-access-control/role-assignments-template.md)
46+
- [Assign Azure roles using the Azure portal](/azure/role-based-access-control/role-assignments-portal.yml)
47+
- [Assign Azure roles using the REST API](/azure/role-based-access-control/role-assignments-rest.md)
48+
- [Assign Azure roles using Azure PowerShell](/azure/role-based-access-control/role-assignments-powershell.md)
49+
- [Assign Azure roles using the Azure CLI](/azure/role-based-access-control/role-assignments-cli.md)
50+
- [Assign Azure roles using Azure Resource Manager templates](/azure/role-based-access-control/role-assignments-template.md)

‎articles/azure-signalr/signalr-concept-authorize-azure-active-directory.md

Lines changed: 14 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,12 @@ The temporary access key expires in 90 minutes. We recommend that you get a new
4444

4545
The workflow is built in the [Azure SignalR Service SDK for app servers](https://github.com/Azure/azure-signalr).
4646

47+
### Cross tenant access when using Microsoft Entra ID
48+
49+
In some cases, your server and your Azure SignalR resource may not in the same tenant for security concerns.
50+
51+
A [Multi-tenant applications](/entra/identity-platform/single-and-multi-tenant-apps#best-practices-for-multitenant-apps) could help you in this scenario.
52+
4753
## Assign Azure roles for access rights
4854

4955
Microsoft Entra ID authorizes access rights to secured resources through [Azure RBAC](../role-based-access-control/overview.md). Azure SignalR Service defines a set of Azure built-in roles that encompass common sets of permissions for accessing Azure SignalR Service resources. You can also define custom roles for access to Azure SignalR Service resources.
@@ -65,19 +71,19 @@ You can scope access to Azure SignalR Service resources at the following levels,
6571

6672
| Role | Description | Use case |
6773
| ------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------- |
68-
| [SignalR App Server](../role-based-access-control/built-in-roles.md#signalr-app-server) | Access to the server connection creation and key generation APIs. | Most commonly used for app server with Azure SignalR resource run in **Default** mode. |
69-
| [SignalR Service Owner](../role-based-access-control/built-in-roles.md#signalr-service-owner) | Full access to all data-plane APIs, including REST APIs, the server connection creation, and key/token generation APIs. | For negotiation server with Azure SignalR resource run in **Serverless** mode, as it requires both REST API permissions and authentication API permissions. |
70-
| [SignalR REST API Owner](../role-based-access-control/built-in-roles.md#signalr-rest-api-owner) | Full access to data-plane REST APIs. | For using [Azure SignalR Management SDK](/azure/azure-signalr/signalr-howto-use-management-sdk) to manage connections and groups, but does **NOT** make server connections or handle negotiation requests. |
71-
| [SignalR REST API Reader](../role-based-access-control/built-in-roles.md#signalr-rest-api-reader) | Read-only access to data-plane REST APIs. | Use it when write a monitoring tool that calls readonly REST APIs.
74+
| [SignalR App Server](/azure/role-based-access-control/built-in-roles.md#signalr-app-server) | Access to the server connection creation and key generation APIs. | Most commonly used for app server with Azure SignalR resource run in **Default** mode. |
75+
| [SignalR Service Owner](/azure/role-based-access-control/built-in-roles.md#signalr-service-owner) | Full access to all data-plane APIs, including REST APIs, the server connection creation, and key/token generation APIs. | For negotiation server with Azure SignalR resource run in **Serverless** mode, as it requires both REST API permissions and authentication API permissions. |
76+
| [SignalR REST API Owner](/azure/role-based-access-control/built-in-roles.md#signalr-rest-api-owner) | Full access to data-plane REST APIs. | For using [Azure SignalR Management SDK](/azure/azure-signalr/signalr-howto-use-management-sdk) to manage connections and groups, but does **NOT** make server connections or handle negotiation requests. |
77+
| [SignalR REST API Reader](/azure/role-based-access-control/built-in-roles.md#signalr-rest-api-reader) | Read-only access to data-plane REST APIs. | Use it when write a monitoring tool that calls readonly REST APIs.
7278

7379
## Next steps
7480

75-
- To learn how to create an Azure application and use Microsoft Entra authorization, see [Authorize requests to Azure SignalR Service resources with Microsoft Entra applications](signalr-howto-authorize-application.md).
81+
- To learn how to create an Azure application and use Microsoft Entra authorization, see [Authorize requests to Azure SignalR Service resources with Microsoft Entra applications](./signalr-howto-authorize-application.md).
7682

77-
- To learn how to configure a managed identity and use Microsoft Entra authorization, see [Authorize requests to Azure SignalR Service resources with Microsoft Entra managed identities](signalr-howto-authorize-managed-identity.md).
83+
- To learn how to configure a managed identity and use Microsoft Entra authorization, see [Authorize requests to Azure SignalR Service resources with Microsoft Entra managed identities](./signalr-howto-authorize-managed-identity.md).
7884

79-
- To learn more about roles and role assignments, see [What is Azure role-based access control (Azure RBAC)?](../role-based-access-control/overview.md).
85+
- To learn more about roles and role assignments, see [What is Azure role-based access control (Azure RBAC)?](/azure/role-based-access-control/overview.md).
8086

81-
- To learn how to create custom roles, see [Steps to create a custom role](../role-based-access-control/custom-roles.md#steps-to-create-a-custom-role).
87+
- To learn how to create custom roles, see [Steps to create a custom role](/azure/role-based-access-control/custom-roles.md#steps-to-create-a-custom-role).
8288

8389
- To learn how to use only Microsoft Entra authentication, see [Disable local authentication](./howto-disable-local-auth.md).

‎articles/azure-signalr/signalr-howto-authorize-managed-identity.md

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -62,6 +62,24 @@ services.AddSignalR().AddAzureSignalR(option =>
6262
});
6363
```
6464

65+
### Use multiple endpoints
66+
67+
Credentials can be different for different endpoints.
68+
69+
In this sample, the Azure SignalR SDK will connect to `resource1` with system-assigned managed identity and connect to `resource2` with user-assigned managed identity.
70+
71+
```csharp
72+
services.AddSignalR().AddAzureSignalR(option =>
73+
{
74+
option.Endpoints = new ServiceEndpoint[]
75+
{
76+
var clientId = "<your-user-assigned-identity-client-id>";
77+
new ServiceEndpoint(new Uri("https://<resource1>.service.signalr.net"), new ManagedIdentityCredential()),
78+
new ServiceEndpoint(new Uri("https://<resource2>.service.signalr.net"), new ManagedIdentityCredential(clientId)),
79+
};
80+
});
81+
```
82+
6583

6684
### Azure SignalR Service bindings in Azure Functions
6785

0 commit comments

Comments
 (0)