Multi-Tenant App with dynamic configuration from Azure App Configuration

[vtyagunov]

Hi all,

We are developing MS Teams Tab app that will be distributed to multiple tenants.
The goal is to let customers create their configuration on a tenant level.
For that we found a Azure App Configuration service.

To retrieve settings from Azure App Configuration from the Tab, we thought of these steps:

1. Customer Tenant admin creates Azure App Configuration in their own Domain,
2. Customer Tenant admin adds settings in a specific key,
3. Customer Tenant admin assign the App Configuration Data Reader role to all users in tenant.
4. Our Tenant admin add permission in Azure App Registration to access App Configuration on behalf of user.
5. From Tab app, authenticate user with AAD,
6. From Tab app, request resource from App Configuration via REST API.

Since App Configuration is behind subscription, we want to clarify if the steps are achievable at all.
The questions are:

• In terms of App permissions, what are the permissions we need to include in App Registration, to access Azure App Configuration (in customers tenant) on behalf of user?
• Can Azure ID token from "login.microsoftonline.com" be used to request Azure App Configuration resource via HTTP REST API?

Thanks in advance!

[#2]

@vtyagunov-We are looking into this I will get back to you soon.

[#3]

Thanks for your instant response!
We are waiting for you to share your answers / feedback.

[#4]

@vtyagunov - 1.Permissions we need to include in App Registration, to access Azure App Configuration -Azure AD: Custom Application Consent Policies - Microsoft Tech Community
2.Microsoft identity platform and OAuth 2.0 authorization code flow - Microsoft identity platform | Mi...

[#5]

@vtyagunov -Could you please confirm if your issue has resolved or still looking for any help?

[#6]

@Sayali-MSFT Thanks for sharing these resources.

We are getting through them to understand more about the flow. 

Actually, we have one more question:
In the react feature flags sample. there are steps for creating new AAD app:

• In the API permissions section, select Add a permission and choose APIs my organization uses.
• Pick Azure App Configuration and select the checkboxes and then click Add permissions. This would allow the application to access Azure App Configuration on behalf of the signed-in user.

We tried to create an App following these steps, but there was no "Azure App Configuration" item in "APIs my organization uses" section.
Could you please clarify, what might be a reason of that item not showing up?

As I understood, the cause might be the fact that we don't have a subscription for Azure App Configuration. In fact, the APIs my organization uses section is about our organization's APIs, our Azure App Configuration.
But the goal is to use customer's App Azure Configuration, not ours. Could you please confirm if this is achievable?

Thanks,
Vladimir

[#7]

@vtyagunov-Are you developing any Microsoft Teams app?

[#8]

@Sayali-MSFT 
Yes, we are developing an MS Teams Tab app with react.
And we want to make it a multi-tenant.
And we want to make it configurable via customer's Azure App Configuration key-value pairs.

[#9]

@vtyagunov -Here is sample for refence-Microsoft Teams 'Todo List' sample tab app - Code Samples | Microsoft Docs
https://github.com/OfficeDev/Microsoft-Teams-Samples/tree/main/samples/app-auth/nodejs

[#10]

Hi, @Sayali-MSFT !

Thank you again for the above resources and samples, We reviewed them and unfortunately, those are not really about the things we asked.

We are aware on the how to configure the Azure App and how to setup authentication in MS Teams app.

What we asked is how to access organization's Azure App Configuration on behalf of signed-in user in a multi-tenant app.

Let's say, we own Tenant A and we registered the Azure App under Tenant A.
We distributed the app (manifest file) to other tenants / customers. (Tenant B, Tenant C and etc)
We also enabled Azure App Configuration and saved a json for a specific key.

We want to use it only for users from our tenant.
Users from other tenant has to receive a different json, a json for the same key, but from their Azure App Configuration service.

The desired behavior is -
1. When an Tenant B user signs in - the app has to get the key-value pair from Azure App Configuration in Tenant B.
2. When an Tenant C user signs in - the app has to get the key-value pair from Azure App Configuration in Tenant C.
3. And so on...

By any chance, can you confirm if this is possible?

Thanks!

[#11]

@vtyagunov - Yes it's possible.
Once you get the azure App Id ,Tenant Id on azure portal ,you can configure it in json and your app setting.