0

We have an web application that use Graph APIs, we granted it application permissions in app registration. Now we want to put the application to Microsoft App Source, is it possible to allow user of other tenants to use the permission of the app registration in our tenant? For example, one of the APIs is for creating calendar event to some users in this tenant, if use multi-tenant app registration, can people from other tenant create calendar event in their tenant successfully?

Doris Zhu
  • 1
  • `if use multi-tenant app registration, can people from other tenant create calendar event in their tenant successfully` ---- yes, but the multi-tenant azure ad app should get the permission in other tenant, and when uses in other tenant want to create calendar event in their own tenant, they should set their own tenant id when generate access token. – Tiny Wang Apr 22 '22 at 04:42

1 Answers1

1

if use multi-tenant app registration, can people from other tenant create calendar event in their tenant successfully?

Agree with @Tiny Wang, Yes we can do this , the multi-tenant Azure AD app should obtain authorization from other tenants, and when other tenants wish to create calendar events in their own tenant, they should specify their own tenant id when generating access tokens.

You can implement Get access without a user and use Application permission to access for create calender event .

Make sure that we need to get administrator consent for each tenant where we need to access.

For example if one app is registered in TenantA . And you want to access for create calender event in TenantB. Then we need to do admin consent as mentioned below and Log in with an admin account of TenantB to do the admin consent for TenantB

To access the following url in a browser.

https://login.microsoftonline.com/{TenantB}/adminconsent
?client_id={ app registered in TenantA}
&state=12345
&redirect_uri={app registered  in TenantA}

Then we will get an access token to create an calender event for the tenant B.

For more information please refer the below links:

SO THREAD| Error trying to access other tenant users calendars, using MS Graph API & Multi tenant support for Microsoft Graph API

AjayKumarGhose
  • 4,257
  • 2
  • 4
  • 15
  • This seems to work but how would I go about getting a users tenant id before they've given consent? It seems a bit odd to ask the user their tenant id or their domain before they can consent. And how would I send a get request and receive the response but also show it in the browser to the user? – Baxorr Oct 18 '22 at 19:54
  • I can see there's a generic request you can just use /common instead of a tenant ID but I still don't see how i'd show this to the user and grab the response at the same time. – Baxorr Oct 18 '22 at 20:11