|
1 | 1 | --- |
2 | 2 | title: Authorize an application request by using Microsoft Entra ID |
3 | | -description: Learn how to authorize an application request to Web PubSub resources by using Microsoft Entra ID. |
| 3 | +description: This article provides information about authorizing requests to Azure Web PubSub resources with Microsoft Entra applications. |
4 | 4 | author: terencefan |
5 | 5 | ms.author: tefa |
6 | | -ms.date: 10/12/2024 |
| 6 | +ms.date: 03/11/2025 |
7 | 7 | ms.service: azure-web-pubsub |
8 | 8 | ms.topic: conceptual |
9 | 9 | --- |
10 | 10 |
|
11 | | -# Authorize an application request by using Microsoft Entra ID |
| 11 | +# Authorize requests to Azure Web PubSub resources with Microsoft Entra applications |
12 | 12 |
|
13 | | -Azure Web PubSub supports Microsoft Entra ID for authorizing requests from [applications](../active-directory/develop/app-objects-and-service-principals.md). |
| 13 | +Azure Web PubSub Service supports Microsoft Entra ID for authorizing requests with [Microsoft Entra applications](/entra/identity-platform/app-objects-and-service-principals). |
14 | 14 |
|
15 | | -This article shows you how to configure your Web PubSub resource and code to authorize a request to a Web PubSub resource from an Azure application. |
16 | 15 |
|
17 | | -## Register an application |
| 16 | +This article explains how to set up your resource and code to authenticate requests to the resource using a Microsoft Entra application. |
18 | 17 |
|
19 | | -The first step is to register an Azure application. |
| 18 | +## Register an application in Microsoft Entra ID |
20 | 19 |
|
21 | | -1. In the [Azure portal](https://portal.azure.com/), search for and then select **Microsoft Entra ID**. |
22 | | -1. On the left menu under **Manage**, select **App registrations**. |
23 | | -1. Select **New registration**. |
24 | | -1. For **Name**, enter a name to use for your application. |
25 | | -1. Select **Register** to confirm the application registration. |
| 20 | +The first step is to [Register an application in Microsoft Entra ID](/entra/identity-platform/quickstart-register-app): |
26 | 21 |
|
27 | | -:::image type="content" source="media/howto-authorize-from-application/register-an-application.png" alt-text="Screenshot that shows registering an application."::: |
| 22 | +After you register your application, you can find the **Application (client) ID** and **Directory (tenant) ID** values on the application's overview page. These GUIDs can be useful in the following steps. |
28 | 23 |
|
29 | | -When your application is registered, go to the application overview to view the values for **Application (client) ID** and **Directory (tenant) ID**. You use these values in the following sections. |
30 | | - |
31 | | -:::image type="content" source="media/howto-authorize-from-application/application-overview.png" alt-text="Screenshot that shows an application."::: |
32 | | - |
33 | | -For more information about registering an application, see the quickstart [Register an application by using the Microsoft identity platform](../active-directory/develop/quickstart-register-app.md). |
| 24 | + |
34 | 25 |
|
35 | 26 | ## Add credentials |
36 | 27 |
|
37 | | -You can add both certificates and client secrets (a string) as credentials to your confidential client app registration. |
38 | | - |
39 | | -For more information about adding credentials, see [Add credentials](../active-directory/develop/quickstart-register-app.md#add-credentials). |
40 | | - |
41 | | -### Add a client secret |
42 | | - |
43 | | -The application requires a client secret for a client to prove its identity when it requests a token. |
44 | | - |
45 | | -To create a client secret: |
46 | | - |
47 | | -1. On the left menu under **Manage**, select **Certificates & secrets**. |
48 | | -1. On the **Client secrets** tab, select **New client secret**. |
49 | | - |
50 | | - :::image type="content" source="media/howto-authorize-from-application/new-client-secret.png" alt-text="Screenshot that shows creating a client secret."::: |
51 | | - |
52 | | -1. Enter a description for the client secret, and then choose an **Expires** time for the secret. |
53 | | -1. Copy the value of the client secret and paste it in a secure location for later use. |
54 | | - |
55 | | - > [!NOTE] |
56 | | - > The secret is visible only when you create the secret. You can't view the client secret in the portal later. |
57 | | -
|
58 | | -### Add a certificate |
59 | | - |
60 | | -You can upload a certificate instead of creating a client secret. |
61 | | - |
62 | | -:::image type="content" source="media/howto-authorize-from-application/upload-certificate.png" alt-text="Screenshot that shows uploading a certificate."::: |
63 | | - |
64 | | -## Add a role assignment in the Azure portal |
65 | | - |
66 | | -This section demonstrates how to assign a Web PubSub Service Owner role to a service principal (application) for a Web PubSub resource. |
67 | | - |
68 | | -> [!NOTE] |
69 | | -> You can assign a role to any scope, including management group, subscription, resource group, and single resource. For more information about scope, see [Understand scope for Azure role-based access control](../role-based-access-control/scope-overview.md). |
70 | | -
|
71 | | -1. In the [Azure portal](https://portal.azure.com/), go to your Web PubSub resource. |
72 | | - |
73 | | -1. On the left menu, select **Access control (IAM)** to display access control settings for the resource. |
74 | | - |
75 | | -1. Select the **Role assignments** tab and view the role assignments at this scope. |
76 | | - |
77 | | - The following figure shows an example of the **Access control (IAM)** pane for a Web PubSub resource: |
78 | | - |
79 | | - :::image type="content" source="media/howto-authorize-from-application/access-control.png" alt-text="Screenshot that shows an example of the Access control (IAM) pane."::: |
80 | | - |
81 | | -1. Select **Add** > **Add role assignment**. |
82 | | - |
83 | | -1. Select the **Roles** tab, and then select **Web PubSub Service Owner**. |
84 | | - |
85 | | -1. Select **Next**. |
86 | | - |
87 | | - :::image type="content" source="media/howto-authorize-from-application/add-role-assignment.png" alt-text="Screenshot that shows adding a role assignment."::: |
88 | | - |
89 | | -1. Select the **Members** tab. Under **Assign access to**, select **User, group, or service principal**. |
90 | | - |
91 | | -1. Choose **Select members**. |
92 | | - |
93 | | -1. Search for and select the application to assign the role to. |
94 | | - |
95 | | -1. Choose **Select** to confirm the selection. |
96 | | - |
97 | | -1. Select **Next**. |
98 | | - |
99 | | - :::image type="content" source="media/howto-authorize-from-application/assign-role-to-service-principals.png" alt-text="Screenshot that shows assigning a role to service principals."::: |
100 | | - |
101 | | -1. Select **Review + assign** to confirm the change. |
| 28 | +After registering an app, you can add **certificates, client secrets (a string), or federated identity credentials** as credentials to your confidential client app registration. Credentials allow your application to authenticate as itself, requiring no interaction from a user at runtime, and are used by confidential client applications that access a web API. |
102 | 29 |
|
103 | | -> [!IMPORTANT] |
104 | | -> Azure role assignments might take up to 30 minutes to propagate. |
| 30 | +- [Add a certificate](/entra/identity-platform/quickstart-register-app?tabs=certificate#add-credentials) |
| 31 | +- [Add a client secret](/entra/identity-platform/quickstart-register-app?tabs=client-secret#add-credentials) |
| 32 | +- [Add a federated credential](/entra/identity-platform/quickstart-register-app?tabs=federated-credential#add-credentials) |
105 | 33 |
|
106 | | -To learn more about how to assign and manage Azure role assignments, see these articles: |
| 34 | +## Add role assignments in the Azure portal |
107 | 35 |
|
108 | | -- [Assign Azure roles by using the Azure portal](../role-based-access-control/role-assignments-portal.yml) |
109 | | -- [Assign Azure roles by using REST API](../role-based-access-control/role-assignments-rest.md) |
110 | | -- [Assign Azure roles by using Azure PowerShell](../role-based-access-control/role-assignments-powershell.md) |
111 | | -- [Assign Azure roles by using the Azure CLI](../role-based-access-control/role-assignments-cli.md) |
112 | | -- [Assign Azure roles by using an Azure Resource Manager template](../role-based-access-control/role-assignments-template.md) |
| 36 | +[!INCLUDE [add role assignments](includes/web-pubsub-add-role-assignments.md)] |
113 | 37 |
|
114 | | -## Code samples that use Microsoft Entra authorization |
| 38 | +## Code samples with Microsoft Entra authorization |
115 | 39 |
|
116 | | -Get samples that use Microsoft Entra authorization in our four officially supported programming languages: |
| 40 | +Check out our samples that show how to use Microsoft Entra authorization in programming languages we officially support. |
117 | 41 |
|
118 | 42 | - [C#](./howto-create-serviceclient-with-net-and-azure-identity.md) |
119 | 43 | - [Python](./howto-create-serviceclient-with-python-and-azure-identity.md) |
|
0 commit comments