You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Azure Communication Services now supports Microsoft Entra ID authentication, allowing you to access Azure Communication Services resources directly with Entra ID users. This new support for Entra ID authentication eliminates the need to develop or operate your own identity management or authorization proxy service mentioned in the section [Client-server architecture](#client-server-architecture).
128
+
Azure Communication Services now supports Microsoft Entra ID authentication, allowing you to access Azure Communication Services resources directly with Entra ID users. This new support for Entra ID authentication eliminates the need to develop or operate your own identity management or authorization proxy service mentioned in the section [Client-server architecture](#client-server-architecture-for-the-bring-your-own-identity-byoi-model).
129
129
130
130
The following sections will guide you through the essential aspects of Microsoft Entra ID integration:
Access tokens enable Azure Communication Services SDKs to [authenticate](../../concepts/authentication.md) directly against Azure Communication Services as a particular identity. You need to create access tokens for end users if you want them to join a call or chat thread within your application.
20
20
21
-
This article describes how to use the Azure Communication Services SDKs to create identities and manage your access tokens. For production use cases, we recommend that you generate access tokens on a server-side service as described in [Client and server architecture](../../concepts/identity-model.md#client-server-architecture).
21
+
This article describes how to use the Azure Communication Services SDKs to create identities and manage your access tokens. For production use cases, we recommend that you generate access tokens on a server-side service as described in [Client and server architecture](../../concepts/identity-model.md#client-server-architecture-for-the-bring-your-own-identity-byoi-model).
@@ -22,8 +22,8 @@ This quickstart demonstrates how to use the Communication Services Common SDK al
22
22
23
23
## Prerequisites
24
24
- An Azure account with an active subscription. [Create an account for free](https://azure.microsoft.com/free/?WT.mc_id=A261C142F).
25
-
- An active Azure Communication Services resource and endpoint URI. For more information, see [Create an Azure Communication Services resource](./create-communication-resource.md).
26
-
- A Microsoft Entra ID instance. For more information, see [Microsoft Entra ID overview](./entra/fundamentals/whatis).
25
+
- An active Azure Communication Services resource and endpoint URI. For more information, see [Create an Azure Communication Services resource](../create-communication-resource.md).
26
+
- A Microsoft Entra ID instance. For more information, see [Microsoft Entra ID overview](../../../entra/fundamentals/whatis).
27
27
28
28
## Introduction
29
29
@@ -39,7 +39,7 @@ The Administrator role has extended permissions in Microsoft Entra ID. Members o
39
39
40
40
1. The Contoso Administrator create a service principal for Communication Services Clients application in Contoso Microsoft Entra ID tenant. This step is required to allow the Contoso application to access Communication Services Clients application API permissions.
41
41
1. The Contoso Administrator creates or selects an existing *application* in Microsoft Entra ID. The property *Supported account types* defines whether users from various tenants can authenticate to the application. The property *Redirect URI* redirects a successful authentication request to the Contoso *client application*.
42
-
1. The Contoso Administrator adds required API permissions from Communication Services Clients application. For the all list of the permissions, see [Access tokens with Microsoft Entra ID](./identity-model.md#access-tokens-with-microsoft-entra-id).
42
+
1. The Contoso Administrator adds required API permissions from Communication Services Clients application. For the all list of the permissions, see [Access tokens with Microsoft Entra ID](../../concepts/identity-model.md#access-tokens-with-microsoft-entra-id).
43
43
1. The Contoso Administrator creates or selects existing communication services. The Contoso Administrator grants Fabrikam Entra ID users access to Contoso Azure Communication Services resource. Azure Communication Services Common SDK will be used for Microsoft Entra ID user authentication and in the background seamlessly obtain an Azure Communication Services access token for Microsoft Entra ID user.
44
44
1. The Fabrikam Administrator grants admin consent for the required Communication Services Clients application API permissions to the Contoso application.
45
45
@@ -49,7 +49,7 @@ The Administrator role has extended permissions in Microsoft Entra ID. Members o
49
49
To enable the Contoso application to access Azure Communication Services Clients application API permissions, the Contoso Administrator must create a service principal for Azure Communication Services Clients application in the Contoso Microsoft Entra ID tenant.
50
50
The Contoso Administrator can create a service principal in Contoso tenant by one of the following methods:
51
51
52
-
- Use the [Microsoft Graph REST API](./graph/api/serviceprincipal-post-serviceprincipals?view=graph-rest-1.0&tabs=http#request) to run the following request:
52
+
- Use the [Microsoft Graph REST API](../../../graph/api/serviceprincipal-post-serviceprincipals?view=graph-rest-1.0&tabs=http#request) to run the following request:
53
53
54
54
```http
55
55
POST https://graph.microsoft.com/v1.0/servicePrincipals
@@ -60,9 +60,9 @@ Content-Type: application/json
60
60
}
61
61
```
62
62
63
-
This request can also be executed in [Graph Explorer](./graph/graph-explorer/graph-explorer-overview). Make sure to include your full tenant domain in the URL `https://developer.microsoft.com/graph/graph-explorer?tenant={tenant domain}`, sign in,and provide consent for `Application.ReadWrite.All` permission.
63
+
This request can also be executed in [Graph Explorer](../../../graph/graph-explorer/graph-explorer-overview). Make sure to include your full tenant domain in the URL `https://developer.microsoft.com/graph/graph-explorer?tenant={tenant domain}`, sign in,and provide consent for `Application.ReadWrite.All` permission.
64
64
65
-
- Use the [Azure CLI](./cli/azure/ad/sp?view=azure-cli-latest#az-ad-sp-create) to run the following command:
65
+
- Use the [Azure CLI](../../../cli/azure/ad/sp?view=azure-cli-latest#az-ad-sp-create) to run the following command:
66
66
67
67
```azurecli-interactive
68
68
az ad sp create --id 2a04943b-b6a7-4f65-8786-2bb6131b59f6
@@ -98,9 +98,9 @@ The application must declare Azure Communication Services Clients to have access
98
98
99
99
The Azure Communication Services resource is used to authenticate all requests from Microsoft Entra ID users and to grant them access to the resource.
100
100
101
-
If you want to create a new Communication Services resource, see [Create and manage Communication Services resources](./create-communication-resource.md).
101
+
If you want to create a new Communication Services resource, see [Create and manage Communication Services resources](../create-communication-resource.md).
102
102
103
-
The Contoso administrator can provide Fabrikam Entra ID users with access to the Contoso Azure Communication Services resource through the Azure portal or by using the [Entra ID Assignment REST API](./rest/api/communication/identity/entra-id-assignment).
103
+
The Contoso administrator can provide Fabrikam Entra ID users with access to the Contoso Azure Communication Services resource through the Azure portal or by using the [Entra ID Assignment REST API](../../../rest/api/communication/identity/entra-id-assignment).
104
104
105
105
In the Azure portal follow these steps:
106
106
1. Navigate to your Communication Services resource.
@@ -122,11 +122,11 @@ The following roles can provide consent on behalf of a company:
122
122
- Application admin
123
123
- Cloud application admin
124
124
125
-
If you want to check roles in Azure portal, see [List Azure role assignments](../../role-based-access-control/role-assignments-list-portal.yml).
125
+
If you want to check roles in Azure portal, see [List Azure role assignments](../../../role-based-access-control/role-assignments-list-portal.yml).
126
126
127
127
To construct an Administrator consent URL, the Fabrikam Microsoft Entra Administrator does the following steps:
128
128
129
-
1. In the URL *https://login.microsoftonline.com/{Tenant_ID}/adminconsent?client_id={Application_ID}*, the Administrator replaces {Tenant_ID} with the Fabrikam [Tenant ID](../concepts/troubleshooting-info.md#get-a-directory-id), and replaces {Application_ID} with the Contoso [Application ID](../concepts/troubleshooting-info.md#get-an-application-id).
129
+
1. In the URL *https://login.microsoftonline.com/{Tenant_ID}/adminconsent?client_id={Application_ID}*, the Administrator replaces {Tenant_ID} with the Fabrikam [Tenant ID](../concepts/troubleshooting-info.md#get-a-directory-id), and replaces {Application_ID} with the Contoso [Application ID](../../concepts/troubleshooting-info.md#get-an-application-id).
130
130
1. The Administrator logs in and grants permissions on behalf of the organization.
131
131
132
132
The service principal of the Contoso application in the Fabrikam tenant is created if consent is granted. The Fabrikam Administrator can review the consent in Microsoft Entra ID by doing the following steps:
0 commit comments