Skip to content

Commit 397564a

Browse files
terencefanterencefan
authored
123
1 parent 14aa331 commit 397564a

File tree

4 files changed

+41
-19
lines changed

4 files changed

+41
-19
lines changed

‎articles/azure-signalr/includes/signalr-add-role-assignments.md

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ ms.author: tefa
99
ms.custom: include file
1010
---
1111

12-
The following steps describe how to assign a **SignalR App Server** role to a service principal or a managed identity for an Azure SignalR Service resource. For detailed steps, see [Assign Azure roles using the Azure portal](/azure/role-based-access-control/role-assignments-portal.yml).
12+
The following steps describe how to assign a **SignalR App Server** role to a service principal or a managed identity for an Azure SignalR Service resource. For detailed steps, see [Assign Azure roles using the Azure portal](../../role-based-access-control/role-assignments-portal.yml).
1313

1414
> [!NOTE]
1515
> A role can be assigned to any scope, including management group, subscription, resource group, or single resource. To learn more about scope, see [Understand scope for Azure RBAC](../role-based-access-control/scope-overview.md).
@@ -20,16 +20,16 @@ The following steps describe how to assign a **SignalR App Server** role to a se
2020

2121
1. Select **Add** > **Add role assignment**.
2222

23-
:::image type="content" source="~/reusable-content/ce-skilling/azure/media/role-based-access-control/add-role-assignment-menu-generic.png" alt-text="Screenshot that shows the page for access control and selections for adding a role assignment.":::
23+
:::image type="content" source="~/reusable-content/ce-skilling../../media/role-based-access-control/add-role-assignment-menu-generic.png" alt-text="Screenshot that shows the page for access control and selections for adding a role assignment.":::
2424

2525
1. On the **Role** tab, select **SignalR App Server** or other SignalR built-in roles depends on your scenario.
2626

2727
| Role | Description | Use case |
2828
| ------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------- |
29-
| [SignalR App Server](/azure/role-based-access-control/built-in-roles.md#signalr-app-server) | Access to the server connection creation and key generation APIs. | Most commonly used for app server with Azure SignalR resource run in **Default** mode. |
30-
| [SignalR Service Owner](/azure/role-based-access-control/built-in-roles.md#signalr-service-owner) | Full access to all data-plane APIs, including REST APIs, the server connection creation, and key/token generation APIs. | For negotiation server with Azure SignalR resource run in **Serverless** mode, as it requires both REST API permissions and authentication API permissions. |
31-
| [SignalR REST API Owner](/azure/role-based-access-control/built-in-roles.md#signalr-rest-api-owner) | Full access to data-plane REST APIs. | For using [Azure SignalR Management SDK](/azure/azure-signalr/signalr-howto-use-management-sdk) to manage connections and groups, but does **NOT** make server connections or handle negotiation requests. |
32-
| [SignalR REST API Reader](/azure/role-based-access-control/built-in-roles.md#signalr-rest-api-reader) | Read-only access to data-plane REST APIs. | Use it when write a monitoring tool that calls readonly REST APIs. |
29+
| [SignalR App Server](../../role-based-access-control/built-in-roles.md#signalr-app-server) | Access to the server connection creation and key generation APIs. | Most commonly used for app server with Azure SignalR resource run in **Default** mode. |
30+
| [SignalR Service Owner](../../role-based-access-control/built-in-roles.md#signalr-service-owner) | Full access to all data-plane APIs, including REST APIs, the server connection creation, and key/token generation APIs. | For negotiation server with Azure SignalR resource run in **Serverless** mode, as it requires both REST API permissions and authentication API permissions. |
31+
| [SignalR REST API Owner](../../role-based-access-control/built-in-roles.md#signalr-rest-api-owner) | Full access to data-plane REST APIs. | For using [Azure SignalR Management SDK](/azure/azure-signalr/signalr-howto-use-management-sdk) to manage connections and groups, but does **NOT** make server connections or handle negotiation requests. |
32+
| [SignalR REST API Reader](../../role-based-access-control/built-in-roles.md#signalr-rest-api-reader) | Read-only access to data-plane REST APIs. | Use it when write a monitoring tool that calls readonly REST APIs. |
3333

3434
1. click Next.
3535

@@ -52,8 +52,8 @@ The following steps describe how to assign a **SignalR App Server** role to a se
5252
5353
To learn more about how to assign and manage Azure roles, see these articles:
5454

55-
- [Assign Azure roles using the Azure portal](/azure/role-based-access-control/role-assignments-portal.yml)
56-
- [Assign Azure roles using the REST API](/azure/role-based-access-control/role-assignments-rest.md)
57-
- [Assign Azure roles using Azure PowerShell](/azure/role-based-access-control/role-assignments-powershell.md)
58-
- [Assign Azure roles using the Azure CLI](/azure/role-based-access-control/role-assignments-cli.md)
59-
- [Assign Azure roles using Azure Resource Manager templates](/azure/role-based-access-control/role-assignments-template.md)
55+
- [Assign Azure roles using the Azure portal](../../role-based-access-control/role-assignments-portal.yml)
56+
- [Assign Azure roles using the REST API](../../role-based-access-control/role-assignments-rest.md)
57+
- [Assign Azure roles using Azure PowerShell](../../role-based-access-control/role-assignments-powershell.md)
58+
- [Assign Azure roles using the Azure CLI](../../role-based-access-control/role-assignments-cli.md)
59+
- [Assign Azure roles using Azure Resource Manager templates](../../role-based-access-control/role-assignments-template.md)

‎articles/azure-signalr/signalr-concept-authorize-azure-active-directory.md

Lines changed: 14 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -50,6 +50,14 @@ In some cases, your server and your Azure SignalR resource may not in the same t
5050

5151
A [Multi-tenant applications](/entra/identity-platform/single-and-multi-tenant-apps#best-practices-for-multitenant-apps) could help you in this scenario.
5252

53+
If you've already registered a single-tenant app, see [convert your single-tenant app to multitenant](/entra/identity-platform/howto-convert-app-to-be-multi-tenant).
54+
55+
Once you have registered the multi-tenant application in your `tenantA`, you should provision it as an enterprise application in your `tenantB`.
56+
57+
[Create an enterprise application from a multitenant application in Microsoft Entra ID](/entra/identity/enterprise-apps/create-service-principal-cross-tenant?pivots=msgraph-powershell)
58+
59+
The application registered in your `tenantA` and the enterprise application provisioned in your `tenantB` share the same Application (client) id.
60+
5361
## Assign Azure roles for access rights
5462

5563
Microsoft Entra ID authorizes access rights to secured resources through [Azure RBAC](../role-based-access-control/overview.md). Azure SignalR Service defines a set of Azure built-in roles that encompass common sets of permissions for accessing Azure SignalR Service resources. You can also define custom roles for access to Azure SignalR Service resources.
@@ -71,19 +79,19 @@ You can scope access to Azure SignalR Service resources at the following levels,
7179

7280
| Role | Description | Use case |
7381
| ------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------- |
74-
| [SignalR App Server](/azure/role-based-access-control/built-in-roles.md#signalr-app-server) | Access to the server connection creation and key generation APIs. | Most commonly used for app server with Azure SignalR resource run in **Default** mode. |
75-
| [SignalR Service Owner](/azure/role-based-access-control/built-in-roles.md#signalr-service-owner) | Full access to all data-plane APIs, including REST APIs, the server connection creation, and key/token generation APIs. | For negotiation server with Azure SignalR resource run in **Serverless** mode, as it requires both REST API permissions and authentication API permissions. |
76-
| [SignalR REST API Owner](/azure/role-based-access-control/built-in-roles.md#signalr-rest-api-owner) | Full access to data-plane REST APIs. | For using [Azure SignalR Management SDK](/azure/azure-signalr/signalr-howto-use-management-sdk) to manage connections and groups, but does **NOT** make server connections or handle negotiation requests. |
77-
| [SignalR REST API Reader](/azure/role-based-access-control/built-in-roles.md#signalr-rest-api-reader) | Read-only access to data-plane REST APIs. | Use it when write a monitoring tool that calls readonly REST APIs.
82+
| [SignalR App Server](../role-based-access-control/built-in-roles.md#signalr-app-server) | Access to the server connection creation and key generation APIs. | Most commonly used for app server with Azure SignalR resource run in **Default** mode. |
83+
| [SignalR Service Owner](../role-based-access-control/built-in-roles.md#signalr-service-owner) | Full access to all data-plane APIs, including REST APIs, the server connection creation, and key/token generation APIs. | For negotiation server with Azure SignalR resource run in **Serverless** mode, as it requires both REST API permissions and authentication API permissions. |
84+
| [SignalR REST API Owner](../role-based-access-control/built-in-roles.md#signalr-rest-api-owner) | Full access to data-plane REST APIs. | For using [Azure SignalR Management SDK](./signalr-howto-use-management-sdk) to manage connections and groups, but does **NOT** make server connections or handle negotiation requests. |
85+
| [SignalR REST API Reader](../role-based-access-control/built-in-roles.md#signalr-rest-api-reader) | Read-only access to data-plane REST APIs. | Use it when write a monitoring tool that calls readonly REST APIs.
7886

7987
## Next steps
8088

8189
- To learn how to create an Azure application and use Microsoft Entra authorization, see [Authorize requests to Azure SignalR Service resources with Microsoft Entra applications](./signalr-howto-authorize-application.md).
8290

8391
- To learn how to configure a managed identity and use Microsoft Entra authorization, see [Authorize requests to Azure SignalR Service resources with Microsoft Entra managed identities](./signalr-howto-authorize-managed-identity.md).
8492

85-
- To learn more about roles and role assignments, see [What is Azure role-based access control (Azure RBAC)?](/azure/role-based-access-control/overview.md).
93+
- To learn more about roles and role assignments, see [What is Azure role-based access control (Azure RBAC)?](../role-based-access-control/overview.md).
8694

87-
- To learn how to create custom roles, see [Steps to create a custom role](/azure/role-based-access-control/custom-roles.md#steps-to-create-a-custom-role).
95+
- To learn how to create custom roles, see [Steps to create a custom role](../role-based-access-control/custom-roles.md#steps-to-create-a-custom-role).
8896

8997
- To learn how to use only Microsoft Entra authentication, see [Disable local authentication](./howto-disable-local-auth.md).

‎articles/azure-signalr/signalr-howto-authorize-application.md

Lines changed: 14 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,9 @@ After registering an app, you can add **certificates, client secrets (a string),
4444
The Azure SignalR server SDK leverages the [Azure.Identity library](/dotnet/api/overview/azure/identity-readme) to generate tokens for connecting to resources.
4545
Click to explore detailed usages.
4646

47+
> [!NOTE]
48+
> The tenantId must match the tenantId of the tenant where your SignalR resource is in.
49+
4750
### Use Microsoft Entra application with certificate
4851
```csharp
4952
services.AddSignalR().AddAzureSignalR(option =>
@@ -71,9 +74,12 @@ services.AddSignalR().AddAzureSignalR(option =>
7174

7275
### Use Microsoft Entra application with Federated identity
7376

77+
In the case of your organization disabled the usage of client secret/certificate, you can configure the application to trust a managed identity for authentication.
78+
79+
To learn more about it, see [Configure an application to trust a managed identity (preview)](/entra/workload-id/workload-identity-federation-config-app-trust-managed-identity).
80+
7481
> [!NOTE]
7582
> Configure an application to trust a managed identity is a preview feature.
76-
> To learn more about it, see [Configure an application to trust a managed identity (preview)](/entra/workload-id/workload-identity-federation-config-app-trust-managed-identity).
7783
7884
```csharp
7985
services.AddSignalR().AddAzureSignalR(option =>
@@ -90,11 +96,15 @@ services.AddSignalR().AddAzureSignalR(option =>
9096
});
9197

9298
option.Endpoints = [
93-
new ServiceEndpoint(new Uri(), "https://<resource>.service.signalr.net"), credential);
99+
new ServiceEndpoint(new Uri(), "https://<resource>.service.signalr.net"), credential);
94100
];
95101
});
96102
```
97103

104+
This credential will use the user-assigned managed identity to generate a `clientAssertion` and use it to exchange for a `clientToken` for authentication.
105+
106+
The `appClientId` and `tenantId` should be the enterprise application that you provisioned in the tenant of SignalR resource.
107+
98108
### Use multiple endpoints
99109

100110
Credentials can be different for different endpoints.
@@ -115,6 +125,8 @@ services.AddSignalR().AddAzureSignalR(option =>
115125
});
116126
```
117127

128+
More sample can be found in this [Sample link](https://github.com/Azure/azure-signalr/blob/dev/samples/ChatSample/ChatSample/Startup.cs)
129+
118130
## Azure SignalR Service bindings in Azure Functions
119131

120132
Azure SignalR Service bindings in Azure Functions use [application settings](../azure-functions/functions-how-to-use-azure-function-app-settings.md) in the portal or [local.settings.json](../azure-functions/functions-develop-local.md#local-settings-file) locally to configure Microsoft Entra application identities to access your Azure SignalR Service resources.

‎articles/azure-signalr/signalr-howto-authorize-managed-identity.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -62,6 +62,8 @@ services.AddSignalR().AddAzureSignalR(option =>
6262
});
6363
```
6464

65+
More sample can be found in this [Sample link](https://github.com/Azure/azure-signalr/blob/dev/samples/ChatSample/ChatSample/Startup.cs)
66+
6567
### Use multiple endpoints
6668

6769
Credentials can be different for different endpoints.

0 commit comments

Comments
 (0)