Hi,
We have a requirement to allow some Azure AD users (we call them app-admins) to invite (using B2B) new users into specific AD groups. The app-admin users own group membership (+ some biz rules) will dictate which groups they can invite new users into.
Therefore we can't grant these users the required permission to (B2B) invite directly. Instead, we have a custom App Registration which exposes our own thin API, which makes calls to the Graph API in the context of the application (which has been granted permission to invite) rather than the user.
We require that consumers of our API may only call it within the context of a user, so we can make the necessary decisions about what to allow/block.
I have two questions I hope you can help with:
- Does this architecture appear sound? Just checking there isn't something built-in to AD we are missing!
- We can flow the user identity as far as our API - before it's replaced with an application level permission. Ideally we'd love to see the user who invited the new user in the AD audit logs, but as the user was ultimately invited by the application I'm guessing this isn't possible. We can't use anything like on_behalf_of as the user doesn't have permission to perform the ultimate action in AD.
Thanks!
J
