You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/static-web-apps/assign-roles-microsoft-graph.md
+19-19Lines changed: 19 additions & 19 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,30 +1,30 @@
1
1
---
2
2
title: "Tutorial: Assign Azure Static Web Apps roles with Microsoft Graph"
3
-
description: Learn to use a serverless function to assign custom user roles based on Active Directory group membership.
3
+
description: Learn to use a serverless function to assign custom user roles based on Entra ID group membership.
4
4
services: static-web-apps
5
5
author: craigshoemaker
6
6
ms.service: static-web-apps
7
7
ms.topic: tutorial
8
-
ms.date: 07/11/2023
8
+
ms.date: 06/13/2024
9
9
ms.author: cshoe
10
10
keywords: "static web apps authorization, assign user roles, custom roles"
11
11
---
12
12
13
13
# Tutorial: Assign custom roles with a function and Microsoft Graph
14
14
15
-
This article demonstrates how to use a function to query [Microsoft Graph](https://developer.microsoft.com/graph) and assign custom roles to a user based on their Active Directory group membership.
15
+
This article demonstrates how to use a function to query [Microsoft Graph](https://developer.microsoft.com/graph) and assign custom roles to a user based on their Entra ID group membership.
16
16
17
17
In this tutorial, you learn to:
18
18
19
19
- Deploy a static web app.
20
20
- Create a Microsoft Entra app registration.
21
21
- Set up custom authentication with Microsoft Entra ID.
22
-
- Configure a [serverless function](authentication-custom.md#manage-roles) that queries the user's Active Directory group membership and returns a list of custom roles.
22
+
- Configure a [serverless function](authentication-custom.md#manage-roles) that queries the user's Entra ID group membership and returns a list of custom roles.
23
23
24
24
> [!NOTE]
25
25
> This tutorial requires you to [use a function to assign roles](authentication-custom.md#manage-roles). Function-based role management is currently in preview. The permission level required to complete this tutorial is "User.Read.All".
26
26
27
-
There's a function named *GetRoles* in the app's API. This function uses the user's access token to query Active Directory from Microsoft Graph. If the user is a member of any groups defined in the app, then the corresponding custom roles are mapped to the user.
27
+
There's a function named *GetRoles* in the app's API. This function uses the user's access token to query Entra ID from Microsoft Graph. If the user is a member of any groups defined in the app, then the corresponding custom roles are mapped to the user.
28
28
29
29
## Prerequisites
30
30
@@ -89,7 +89,7 @@ There's a function named *GetRoles* in the app's API. This function uses the use
89
89
90
90
1. Once the process is complete, select **Go to resource** to open your new static web app.
91
91
92
-
1. In the overview section, locate your application's **URL**. Copy this value into a text editor to use in upcoming steps to set up Active Directory authentication.
92
+
1. In the overview section, locate your application's **URL**. Copy this value into a text editor to use in upcoming steps to set up Entra authentication.
@@ -113,7 +113,7 @@ There's a function named *GetRoles* in the app's API. This function uses the use
113
113
114
114
1. After the app registration is created, copy the **Application (client) ID** and **Directory (tenant) ID** in the *Essentials* section to a text editor.
115
115
116
-
You need these values to configure Active Directory authentication in your static web app.
116
+
You need these values to configure Entra ID authentication in your static web app.
117
117
118
118
### Enable ID tokens
119
119
@@ -142,11 +142,11 @@ There's a function named *GetRoles* in the app's API. This function uses the use
142
142
143
143
1. Copy the **Value** of the client secret you created to a text editor.
144
144
145
-
You need this value to configure Active Directory authentication in your static web app.
145
+
You need this value to configure Entra ID authentication in your static web app.
146
146
147
147
:::image type="content" source="media/assign-roles-microsoft-graph/create-client-secret.png" alt-text="Create a client secret":::
148
148
149
-
## Configure Active Directory authentication
149
+
## Configure Entra ID authentication
150
150
151
151
1. In a browser, open the GitHub repository containing the static web app you deployed.
152
152
@@ -159,9 +159,9 @@ There's a function named *GetRoles* in the app's API. This function uses the use
@@ -186,7 +186,7 @@ There's a function named *GetRoles* in the app's API. This function uses the use
186
186
187
187
1. Select **Edit** to update the file.
188
188
189
-
1. Update the *openIdIssuer* value of `https://login.microsoftonline.com/<YOUR_AAD_TENANT_ID>` by replacing `<YOUR_AAD_TENANT_ID>` with the directory (tenant) ID of your Microsoft Entra ID.
189
+
1. Update the *openIdIssuer* value of `https://login.microsoftonline.com/<YOUR_ENTRA_TENANT_ID>` by replacing `<YOUR_ENTRA_TENANT_ID>` with the directory (tenant) ID of your Microsoft Entra ID.
190
190
191
191
1. Select **Commit changes...**.
192
192
@@ -202,14 +202,14 @@ There's a function named *GetRoles* in the app's API. This function uses the use
202
202
203
203
| Name | Value |
204
204
|---|---|
205
-
| `AAD_CLIENT_ID` | Your Active Directory application (client) ID. |
206
-
| `AAD_CLIENT_SECRET` | Your Active Directory application client secret value. |
205
+
| `ENTRA_CLIENT_ID` | Your Entra ID application (client) ID. |
206
+
| `ENTRA_CLIENT_SECRET` | Your Entra application client secret value. |
207
207
208
208
1. Select **Save**.
209
209
210
210
## Create roles
211
211
212
-
1. Open you Active Directory app registration in the Azure portal.
212
+
1. Open you Entra ID app registration in the Azure portal.
213
213
214
214
1. Under *Manage*, select **App roles**.
215
215
@@ -253,9 +253,9 @@ Based on the user's group memberships, the function assigns custom roles to the
253
253
};
254
254
```
255
255
256
-
The *GetRoles* function is called whenever a user is successfully authenticated with Microsoft Entra ID. The function uses the user's access token to query their Active Directory group membership from Microsoft Graph. If the user is a member of any groups defined in the `roleGroupMappings` object, then the corresponding custom roles are returned.
256
+
The *GetRoles* function is called whenever a user is successfully authenticated with Microsoft Entra ID. The function uses the user's access token to query their Entra group membership from Microsoft Graph. If the user is a member of any groups defined in the `roleGroupMappings` object, then the corresponding custom roles are returned.
257
257
258
-
In the above example, if a user is a member of the Active Directory group with ID `b6059db5-9cef-4b27-9434-bb793aa31805`, they're granted the `reader` role.
258
+
In the above example, if a user is a member of the Entra ID group with ID `b6059db5-9cef-4b27-9434-bb793aa31805`, they're granted the `reader` role.
259
259
260
260
1. Select **Commit changes...**.
261
261
@@ -267,7 +267,7 @@ Based on the user's group memberships, the function assigns custom roles to the
267
267
268
268
1. Sign in to your static web app using Microsoft Entra ID.
269
269
270
-
1. When you're logged in, the sample app displays the list of roles that you're assigned based on your identity's Active Directory group membership.
270
+
1. When you're logged in, the sample app displays the list of roles that you're assigned based on your identity's Entra ID group membership.
271
271
272
272
Depending on these roles, you're permitted or prohibited to access some of the routes in the app.
0 commit comments