Skip to content

Commit e6a9096

Browse files
v-ccolinv-ccolin
authored
Merge pull request #296364 from terencefan/tefa/update-msi
update signalr msi docs
2 parents 95c2a85 + 6aae987 commit e6a9096

File tree

4 files changed

+136
-118
lines changed

4 files changed

+136
-118
lines changed

‎articles/azure-signalr/includes/signalr-add-role-assignments.md

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
---
2+
title: include file
3+
description: include file
4+
author: terencefan
5+
ms.service: azure-signalr-service
6+
ms.topic: include
7+
ms.date: 03/12/2025
8+
ms.author: tefa
9+
ms.custom: include file
10+
---
11+
12+
The following steps describe how to assign a **SignalR App Server** role to a service principal or a managed identity for an Azure SignalR Service resource. For detailed steps, see [Assign Azure roles using the Azure portal](../../role-based-access-control/role-assignments-portal.yml).
13+
14+
> [!NOTE]
15+
> A role can be assigned to any scope, including management group, subscription, resource group, or single resource. To learn more about scope, see [Understand scope for Azure RBAC](../../role-based-access-control/scope-overview.md).
16+
17+
1. In the [Azure portal](https://portal.azure.com/), go to your Azure SignalR Service resource.
18+
19+
1. Select **Access control (IAM)** in the sidebar.
20+
21+
1. Select **Add** > **Add role assignment**.
22+
23+
:::image type="content" source="~/reusable-content/ce-skilling/azure/media/role-based-access-control/add-role-assignment-menu-generic.png" alt-text="Screenshot that shows the page for access control and selections for adding a role assignment.":::
24+
25+
1. On the **Role** tab, select **SignalR App Server** or other SignalR built-in roles depends on your scenario.
26+
27+
| Role | Description | Use case |
28+
| ------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------- |
29+
| [SignalR App Server](../../role-based-access-control/built-in-roles.md#signalr-app-server) | Access to the server connection creation and key generation APIs. | Most commonly used for app server with Azure SignalR resource run in **Default** mode. |
30+
| [SignalR Service Owner](../../role-based-access-control/built-in-roles.md#signalr-service-owner) | Full access to all data-plane APIs, including REST APIs, the server connection creation, and key/token generation APIs. | For negotiation server with Azure SignalR resource run in **Serverless** mode, as it requires both REST API permissions and authentication API permissions. |
31+
| [SignalR REST API Owner](../../role-based-access-control/built-in-roles.md#signalr-rest-api-owner) | Full access to data-plane REST APIs. | For using [Azure SignalR Management SDK](/azure/azure-signalr/signalr-howto-use-management-sdk) to manage connections and groups, but does **NOT** make server connections or handle negotiation requests. |
32+
| [SignalR REST API Reader](../../role-based-access-control/built-in-roles.md#signalr-rest-api-reader) | Read-only access to data-plane REST APIs. | Use it when write a monitoring tool that calls readonly REST APIs. |
33+
34+
1. Select Next.
35+
36+
37+
1. For Microsoft Entra application.
38+
39+
40+
1. In the `Assign access` to row, select **User, group, or service principal**.
41+
1. In the `Members` row, click `select members`, then choose the identity in the pop-up window.
42+
43+
1. For managed identity for Azure resources.
44+
45+
1. In the `Assign access` to row, select **Managed identity**.
46+
1. In the `Members` row, click `select members`, then choose the application in the pop-up window.
47+
48+
1. Select Next.
49+
50+
51+
1. Review your assignment, then click **Review + assign** to confirm the role assignment.
52+
53+
> [!IMPORTANT]
54+
> Newly added role assignments might take up to 30 minutes to propagate.
55+
56+
To learn more about how to assign and manage Azure roles, see these articles:
57+
58+
- [Assign Azure roles using the Azure portal](../../role-based-access-control/role-assignments-portal.yml)
59+
- [Assign Azure roles using the REST API](../../role-based-access-control/role-assignments-rest.md)
60+
- [Assign Azure roles using Azure PowerShell](../../role-based-access-control/role-assignments-powershell.md)
61+
- [Assign Azure roles using the Azure CLI](../../role-based-access-control/role-assignments-cli.md)
62+
- [Assign Azure roles using Azure Resource Manager templates](../../role-based-access-control/role-assignments-template.md)

‎articles/azure-signalr/signalr-concept-authorize-azure-active-directory.md

Lines changed: 22 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@ When a security principal tries to access an Azure SignalR Service resource, the
3333

3434
When you use an access key, the key is shared between your app server (or function app) and the Azure SignalR Service resource. Azure SignalR Service authenticates the client connection request by using the shared key.
3535

36-
When you use Microsoft Entra ID, there is no shared key. Instead, Azure SignalR Service uses a *temporary access key* for signing tokens used in client connections. The workflow contains four steps:
36+
When you use Microsoft Entra ID, there's no shared key. Instead, Azure SignalR Service uses a *temporary access key* for signing tokens used in client connections. The workflow contains four steps:
3737

3838
1. The security principal requires an OAuth 2.0 token from Microsoft Entra ID to authenticate itself.
3939
2. The security principal calls the SignalR authentication API to get a temporary access key.
@@ -44,13 +44,27 @@ The temporary access key expires in 90 minutes. We recommend that you get a new
4444

4545
The workflow is built in the [Azure SignalR Service SDK for app servers](https://github.com/Azure/azure-signalr).
4646

47+
### Cross tenant access when using Microsoft Entra ID
48+
49+
In some cases, your server and your Azure SignalR resource may not be in the same tenant due to security concerns.
50+
51+
A [multitenant applications](/entra/identity-platform/single-and-multi-tenant-apps#best-practices-for-multitenant-apps) could help you in this scenario.
52+
53+
If you've already registered a single-tenant app, see [convert your single-tenant app to multitenant](/entra/identity-platform/howto-convert-app-to-be-multi-tenant).
54+
55+
Once you have registered the multitenant application in your `tenantA`, you should provision it as an enterprise application in your `tenantB`.
56+
57+
[Create an enterprise application from a multitenant application in Microsoft Entra ID](/entra/identity/enterprise-apps/create-service-principal-cross-tenant?pivots=msgraph-powershell)
58+
59+
The application registered in your `tenantA` and the enterprise application provisioned in your `tenantB` share the same Application (client) ID.
60+
4761
## Assign Azure roles for access rights
4862

4963
Microsoft Entra ID authorizes access rights to secured resources through [Azure RBAC](../role-based-access-control/overview.md). Azure SignalR Service defines a set of Azure built-in roles that encompass common sets of permissions for accessing Azure SignalR Service resources. You can also define custom roles for access to Azure SignalR Service resources.
5064

5165
### Resource scope
5266

53-
You might have to determine the scope of access that the security principal should have before you assign any Azure RBAC role to a security principal. We recommend that you grant only the narrowest possible scope. Azure RBAC roles defined at a broader scope are inherited by the resources beneath them.
67+
Before assigning Azure RBAC roles to a security principal, it’s essential to define the appropriate scope of access they should have. We advise granting the most limited scope necessary to minimize unnecessary permissions. Keep in mind that Azure RBAC roles assigned at a higher or broader scope are automatically inherited by the resources nested within that scope.
5468

5569
You can scope access to Azure SignalR Service resources at the following levels, beginning with the narrowest scope.
5670

@@ -65,16 +79,16 @@ You can scope access to Azure SignalR Service resources at the following levels,
6579

6680
| Role | Description | Use case |
6781
| ------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------- |
68-
| [SignalR App Server](../role-based-access-control/built-in-roles.md#signalr-app-server) | Access to the WebSocket connection creation API and authentication APIs. | Most commonly used for an app server. |
69-
| [SignalR Service Owner](../role-based-access-control/built-in-roles.md#signalr-service-owner) | Full access to all data-plane APIs, including REST APIs, the WebSocket connection creation API, and authentication APIs. | Use for *serverless mode* for authorization with Microsoft Entra ID, because it requires both REST API permissions and authentication API permissions. |
70-
| [SignalR REST API Owner](../role-based-access-control/built-in-roles.md#signalr-rest-api-owner) | Full access to data-plane REST APIs. | Often used to write a tool that manages connections and groups, but does *not* make connections or call authentication APIs. |
71-
| [SignalR REST API Reader](../role-based-access-control/built-in-roles.md#signalr-rest-api-reader) | Read-only access to data-plane REST APIs. | Commonly used to write a monitoring tool that calls *only* Azure SignalR Service data-plane read-only REST APIs. |
82+
| [SignalR App Server](../role-based-access-control/built-in-roles.md#signalr-app-server) | Access to the server connection creation and key generation APIs. | Most commonly used for app server with Azure SignalR resource run in **Default** mode. |
83+
| [SignalR Service Owner](../role-based-access-control/built-in-roles.md#signalr-service-owner) | Full access to all data-plane APIs, including REST APIs, the server connection creation, and key/token generation APIs. | For negotiation server with Azure SignalR resource run in **Serverless** mode, as it requires both REST API permissions and authentication API permissions. |
84+
| [SignalR REST API Owner](../role-based-access-control/built-in-roles.md#signalr-rest-api-owner) | Full access to data-plane REST APIs. | For using [Azure SignalR Management SDK](./signalr-howto-use-management-sdk.md) to manage connections and groups, but does **NOT** make server connections or handle negotiation requests. |
85+
| [SignalR REST API Reader](../role-based-access-control/built-in-roles.md#signalr-rest-api-reader) | Read-only access to data-plane REST APIs. | Use it when write a monitoring tool that calls readonly REST APIs.
7286

7387
## Next steps
7488

75-
- To learn how to create an Azure application and use Microsoft Entra authorization, see [Authorize requests to Azure SignalR Service resources with Microsoft Entra applications](signalr-howto-authorize-application.md).
89+
- To learn how to create an Azure application and use Microsoft Entra authorization, see [Authorize requests to Azure SignalR Service resources with Microsoft Entra applications](./signalr-howto-authorize-application.md).
7690

77-
- To learn how to configure a managed identity and use Microsoft Entra authorization, see [Authorize requests to Azure SignalR Service resources with Microsoft Entra managed identities](signalr-howto-authorize-managed-identity.md).
91+
- To learn how to configure a managed identity and use Microsoft Entra authorization, see [Authorize requests to Azure SignalR Service resources with Microsoft Entra managed identities](./signalr-howto-authorize-managed-identity.md).
7892

7993
- To learn more about roles and role assignments, see [What is Azure role-based access control (Azure RBAC)?](../role-based-access-control/overview.md).
8094

‎articles/azure-signalr/signalr-howto-authorize-application.md

Lines changed: 19 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ ms.custom: subject-rbac-steps
1212

1313
# Authorize requests to Azure SignalR Service resources with Microsoft Entra applications
1414

15-
Azure SignalR Service supports Microsoft Entra ID for authorizing requests from [Microsoft Entra applications](/entra/identity-platform/app-objects-and-service-principals).
15+
Azure SignalR Service supports Microsoft Entra ID for authorizing requests with [Microsoft Entra applications](/entra/identity-platform/app-objects-and-service-principals).
1616

1717
This article shows how to configure your Azure SignalR Service resource and codes to authorize requests to the resource from a Microsoft Entra application.
1818

@@ -35,41 +35,17 @@ After registering an app, you can add **certificates, client secrets (a string),
3535

3636
## Add role assignments in the Azure portal
3737

38-
The following steps describe how to assign a SignalR App Server role to a service principal (application) over an Azure SignalR Service resource. For detailed steps, see [Assign Azure roles using the Azure portal](../role-based-access-control/role-assignments-portal.yml).
38+
[!INCLUDE [add role assignments](includes/signalr-add-role-assignments.md)]
3939

40-
> [!NOTE]
41-
> A role can be assigned to any scope, including management group, subscription, resource group, or single resource. To learn more about scope, see [Understand scope for Azure RBAC](../role-based-access-control/scope-overview.md).
42-
43-
1. In the [Azure portal](https://portal.azure.com/), go to your Azure SignalR Service resource.
44-
45-
1. Select **Access control (IAM)**.
46-
47-
1. Select **Add** > **Add role assignment**.
48-
49-
:::image type="content" source="~/reusable-content/ce-skilling/azure/media/role-based-access-control/add-role-assignment-menu-generic.png" alt-text="Screenshot that shows the page for access control and selections for adding a role assignment.":::
50-
51-
1. On the **Role** tab, select **SignalR App Server**.
52-
53-
1. On the **Members** tab, select **User, group, or service principal**, and then choose **Select members**.
54-
55-
1. Search for and select the application to which you want to assign the role.
56-
57-
1. On the **Review + assign** tab, select **Review + assign** to assign the role.
58-
59-
> [!IMPORTANT]
60-
> Azure role assignments might take up to 30 minutes to propagate.
40+
## Configure Microsoft.Azure.SignalR app server SDK for C#
6141

62-
To learn more about how to assign and manage Azure roles, see these articles:
63-
64-
- [Assign Azure roles using the Azure portal](../role-based-access-control/role-assignments-portal.yml)
65-
- [Assign Azure roles using the REST API](../role-based-access-control/role-assignments-rest.md)
66-
- [Assign Azure roles using Azure PowerShell](../role-based-access-control/role-assignments-powershell.md)
67-
- [Assign Azure roles using the Azure CLI](../role-based-access-control/role-assignments-cli.md)
68-
- [Assign Azure roles using Azure Resource Manager templates](../role-based-access-control/role-assignments-template.md)
42+
[Azure SignalR server SDK for C#](https://github.com/Azure/azure-signalr)
6943

70-
## Microsoft.Azure.SignalR app server SDK for C#
44+
The Azure SignalR server SDK leverages the [Azure.Identity library](/dotnet/api/overview/azure/identity-readme) to generate tokens for connecting to resources.
45+
Click to explore detailed usages.
7146

72-
[Azure SignalR server SDK for C#](https://github.com/Azure/azure-signalr)
47+
> [!NOTE]
48+
> The tenantId must match the tenantId of the tenant where your SignalR resource is in.
7349
7450
### Use Microsoft Entra application with certificate
7551
```csharp
@@ -98,9 +74,12 @@ services.AddSignalR().AddAzureSignalR(option =>
9874

9975
### Use Microsoft Entra application with Federated identity
10076

77+
In the case of your organization disabled the usage of client secret/certificate, you can configure the application to trust a managed identity for authentication.
78+
79+
To learn more about it, see [Configure an application to trust a managed identity (preview)](/entra/workload-id/workload-identity-federation-config-app-trust-managed-identity).
80+
10181
> [!NOTE]
10282
> Configure an application to trust a managed identity is a preview feature.
103-
> To learn more about it, see [Configure an application to trust a managed identity (preview)](/entra/workload-id/workload-identity-federation-config-app-trust-managed-identity).
10483
10584
```csharp
10685
services.AddSignalR().AddAzureSignalR(option =>
@@ -117,11 +96,15 @@ services.AddSignalR().AddAzureSignalR(option =>
11796
});
11897

11998
option.Endpoints = [
120-
new ServiceEndpoint(new Uri(), "https://<resource>.service.signalr.net"), credential);
99+
new ServiceEndpoint(new Uri(), "https://<resource>.service.signalr.net"), credential);
121100
];
122101
});
123102
```
124103

104+
This credential will use the user-assigned managed identity to generate a `clientAssertion` and use it to exchange for a `clientToken` for authentication.
105+
106+
The `appClientId` and `tenantId` should be the enterprise application that you provisioned in the tenant of SignalR resource.
107+
125108
### Use multiple endpoints
126109

127110
Credentials can be different for different endpoints.
@@ -142,6 +125,8 @@ services.AddSignalR().AddAzureSignalR(option =>
142125
});
143126
```
144127

128+
More sample can be found in this [Sample link](https://github.com/Azure/azure-signalr/blob/dev/samples/ChatSample/ChatSample/Startup.cs)
129+
145130
## Azure SignalR Service bindings in Azure Functions
146131

147132
Azure SignalR Service bindings in Azure Functions use [application settings](../azure-functions/functions-how-to-use-azure-function-app-settings.md) in the portal or [local.settings.json](../azure-functions/functions-develop-local.md#local-settings-file) locally to configure Microsoft Entra application identities to access your Azure SignalR Service resources.

0 commit comments

Comments
 (0)