You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
@@ -21,7 +21,14 @@ If you offer a Software as a Service (SaaS) application to many organizations, y
21
21
22
22
For existing apps with its own account system (or other sign-ins from other cloud providers), you should add sign-in code via OAuth2, OpenID Connect, or SAML, and put a ["Sign in with Microsoft" button][AAD-App-Branding] in your application.
23
23
24
-
In this how-to guide, you'll undertake the four steps needed to convert a single tenant app into an Azure AD multi-tenant app. You can also refer to the sample; [Build a multi-tenant SaaS web application that calls Microsoft Graph using Azure AD and OpenID Connect](https://github.com/Azure-Samples/active-directory-aspnetcore-webapp-openidconnect-v2/blob/master/2-WebApp-graph-user/2-3-Multi-Tenant/README.md). This how-to assumes familiarity with building a single-tenant application for Azure AD. If not, start with one of the quickstarts on the [developer guide homepage][AAD-Dev-Guide].
24
+
In this how-to guide, you'll undertake the four steps needed to convert a single tenant app into an Azure AD multi-tenant app:
25
+
26
+
1.[Update your application registration to be multi-tenant](#update-registration-to-be-multi-tenant)
27
+
2.[Update your code to send requests to the `/common` endpoint](#update-your-code-to-send-requests-to-common)
28
+
3.[Update your code to handle multiple issuer values](#update-your-code-to-handle-multiple-issuer-values)
29
+
4.[Understand user and admin consent and make appropriate code changes](#understand-user-and-admin-consent-and-make-appropriate-code-changes)
30
+
31
+
You can also refer to the sample; [Build a multi-tenant SaaS web application that calls Microsoft Graph using Azure AD and OpenID Connect](https://github.com/Azure-Samples/active-directory-aspnetcore-webapp-openidconnect-v2/blob/master/2-WebApp-graph-user/2-3-Multi-Tenant/README.md). This how-to assumes familiarity with building a single-tenant application for Azure AD. If not, start with one of the quickstarts on the [developer guide homepage][AAD-Dev-Guide].
25
32
26
33
## Update registration to be multi-tenant
27
34
@@ -45,7 +52,7 @@ Web applications and web APIs receive and validate tokens from the Microsoft ide
45
52
46
53
For example, if a multi-tenant application only allows sign-in from specific tenants who have signed up for their service, then it must check either the `issuer` value or the `tid` claim value in the token to make sure that tenant is in their list of subscribers. If a multi-tenant application only deals with individuals and doesn’t make any access decisions based on tenants, then it can ignore the issuer value altogether.
47
54
48
-
In the [multi-tenant samples][AAD-Samples-MT], issuer validation is disabled to enable any Azure AD tenant to sign in. Because the `/common` endpoint doesn’t correspond to a tenant and isn’t an issuer, when you examine the issuer value in the metadata for `/common` it has a templated URL instead of an actual value:
55
+
In the [multi-tenant samples][AAD-Samples-MT], issuer validation is disabled to enable any Azure AD tenant to sign in. Because the `/common` endpoint doesn’t correspond to a tenant and isn’t an issuer, when you examine the issuer value in the metadata for `/common`, it has a templated URL instead of an actual value:
0 commit comments