You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/static-web-apps/assign-roles-microsoft-graph.md
+11-11Lines changed: 11 additions & 11 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,6 +1,6 @@
1
1
---
2
2
title: "Tutorial: Assign Azure Static Web Apps roles with Microsoft Graph"
3
-
description: Learn to use a serverless function to assign custom user roles based on Entra group membership.
3
+
description: Learn to use a serverless function to assign custom user roles based on Entra ID group membership.
4
4
services: static-web-apps
5
5
author: craigshoemaker
6
6
ms.service: static-web-apps
@@ -12,19 +12,19 @@ keywords: "static web apps authorization, assign user roles, custom roles"
12
12
13
13
# Tutorial: Assign custom roles with a function and Microsoft Graph
14
14
15
-
This article demonstrates how to use a function to query [Microsoft Graph](https://developer.microsoft.com/graph) and assign custom roles to a user based on their Entra group membership.
15
+
This article demonstrates how to use a function to query [Microsoft Graph](https://developer.microsoft.com/graph) and assign custom roles to a user based on their Entra ID group membership.
16
16
17
17
In this tutorial, you learn to:
18
18
19
19
- Deploy a static web app.
20
20
- Create a Microsoft Entra app registration.
21
21
- Set up custom authentication with Microsoft Entra ID.
22
-
- Configure a [serverless function](authentication-custom.md#manage-roles) that queries the user's Entra group membership and returns a list of custom roles.
22
+
- Configure a [serverless function](authentication-custom.md#manage-roles) that queries the user's Entra ID group membership and returns a list of custom roles.
23
23
24
24
> [!NOTE]
25
25
> This tutorial requires you to [use a function to assign roles](authentication-custom.md#manage-roles). Function-based role management is currently in preview. The permission level required to complete this tutorial is "User.Read.All".
26
26
27
-
There's a function named *GetRoles* in the app's API. This function uses the user's access token to query Entra from Microsoft Graph. If the user is a member of any groups defined in the app, then the corresponding custom roles are mapped to the user.
27
+
There's a function named *GetRoles* in the app's API. This function uses the user's access token to query Entra ID from Microsoft Graph. If the user is a member of any groups defined in the app, then the corresponding custom roles are mapped to the user.
28
28
29
29
## Prerequisites
30
30
@@ -113,7 +113,7 @@ There's a function named *GetRoles* in the app's API. This function uses the use
113
113
114
114
1. After the app registration is created, copy the **Application (client) ID** and **Directory (tenant) ID** in the *Essentials* section to a text editor.
115
115
116
-
You need these values to configure Entra authentication in your static web app.
116
+
You need these values to configure Entra ID authentication in your static web app.
117
117
118
118
### Enable ID tokens
119
119
@@ -142,11 +142,11 @@ There's a function named *GetRoles* in the app's API. This function uses the use
142
142
143
143
1. Copy the **Value** of the client secret you created to a text editor.
144
144
145
-
You need this value to configure Entra authentication in your static web app.
145
+
You need this value to configure Entra ID authentication in your static web app.
146
146
147
147
:::image type="content" source="media/assign-roles-microsoft-graph/create-client-secret.png" alt-text="Create a client secret":::
148
148
149
-
## Configure Entra authentication
149
+
## Configure Entra ID authentication
150
150
151
151
1. In a browser, open the GitHub repository containing the static web app you deployed.
152
152
@@ -202,14 +202,14 @@ There's a function named *GetRoles* in the app's API. This function uses the use
202
202
203
203
| Name | Value |
204
204
|---|---|
205
-
| `ENTRA_CLIENT_ID` | Your Entra application (client) ID. |
205
+
| `ENTRA_CLIENT_ID` | Your Entra ID application (client) ID. |
206
206
| `ENTRA_CLIENT_SECRET` | Your Entra application client secret value. |
207
207
208
208
1. Select **Save**.
209
209
210
210
## Create roles
211
211
212
-
1. Open you Entra app registration in the Azure portal.
212
+
1. Open you Entra ID app registration in the Azure portal.
213
213
214
214
1. Under *Manage*, select **App roles**.
215
215
@@ -255,7 +255,7 @@ Based on the user's group memberships, the function assigns custom roles to the
255
255
256
256
The *GetRoles* function is called whenever a user is successfully authenticated with Microsoft Entra ID. The function uses the user's access token to query their Entra group membership from Microsoft Graph. If the user is a member of any groups defined in the `roleGroupMappings` object, then the corresponding custom roles are returned.
257
257
258
-
In the above example, if a user is a member of the Entra group with ID `b6059db5-9cef-4b27-9434-bb793aa31805`, they're granted the `reader` role.
258
+
In the above example, if a user is a member of the Entra ID group with ID `b6059db5-9cef-4b27-9434-bb793aa31805`, they're granted the `reader` role.
259
259
260
260
1. Select **Commit changes...**.
261
261
@@ -267,7 +267,7 @@ Based on the user's group memberships, the function assigns custom roles to the
267
267
268
268
1. Sign in to your static web app using Microsoft Entra ID.
269
269
270
-
1. When you're logged in, the sample app displays the list of roles that you're assigned based on your identity's Entra group membership.
270
+
1. When you're logged in, the sample app displays the list of roles that you're assigned based on your identity's Entra ID group membership.
271
271
272
272
Depending on these roles, you're permitted or prohibited to access some of the routes in the app.
0 commit comments