You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: powerapps-docs/developer/common-data-service/use-single-tenant-server-server-authentication.md
+79-21Lines changed: 79 additions & 21 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -2,13 +2,13 @@
2
2
title: "Use Single-Tenant server-to-server authentication (Common Data Service) | Microsoft Docs"# Intent and product brand in a unique string of 43-59 chars including spaces
3
3
description: "Describes how to access D365 data from an application or service without explicit user authentication."# 115-145 characters including spaces. This abstract displays in the search result.
4
4
ms.custom: ""
5
-
ms.date: 2/21/2019
5
+
ms.date: 12/20/2019
6
6
ms.reviewer: "pehecke"
7
7
ms.service: powerapps
8
8
ms.topic: "article"
9
9
author: "paulliew"# GitHub ID
10
-
ms.author: "jdaly"# MSFT alias of Microsoft employees only
11
-
manager: "ryjones"# MSFT alias of manager or PM counterpart
10
+
ms.author: "pehecke"# MSFT alias of Microsoft employees only
11
+
manager: "kvivek"# MSFT alias of manager or PM counterpart
12
12
search.audienceType:
13
13
- developer
14
14
search.app:
@@ -17,9 +17,9 @@ search.app:
17
17
---
18
18
# Use Single-Tenant server-to-server authentication
19
19
20
-
The single-tenant server-to-server scenario typically applies for enterprise organizations who have multiple Common Data Service environments using Active Directory Federation Services (AD FS) for authentication. However, it can also be applied by environments when the application won't be distributed to other environments.
20
+
The single-tenant server-to-server scenario typically applies for enterprise organizations that have multiple Common Data Service environments using Active Directory Federation Services (AD FS) for authentication. However, it can also be applied by environments when the application won't be distributed to other environments.
21
21
22
-
An enterprise can create a web application or service to connect to any Common Data Service environments associated with a single Azure Active Directory (AD) tenant.
22
+
An enterprise can create a web application or service to connect to any Common Data Service environments associated with a single Azure Active Directory (Azure AD) tenant.
23
23
24
24
## Differences from multi-tenant scenario
25
25
Creating a web application or service for a single-tenant server-to-server authentication is similar to that used for a multi-tenant organization but there are some important differences.
@@ -37,47 +37,105 @@ In the [See also](#bkmk_seealso) section at the end of this article, there are l
37
37
38
38
- An Azure AD tenant to use when registering the provided sample application.
39
39
- A Common Data Service subscription that is associated with the Azure AD tenant.
40
-
- Administrator privileges in the Azure AD tenant and D365 organization.
40
+
- Administrator privileges in the Azure AD tenant and Common Data Service environment.
41
41
42
42
<aname="bkmk_registration"></a>
43
43
## Azure application registration
44
44
To create an application registration in Azure AD, follow these steps.
45
45
46
-
1. Navigate to https://admin.microsoft.com and sign in, or from your D365 organization web page select the application launcher in the top left corner.
46
+
1. Navigate to https://admin.microsoft.com and sign in, or from your Common Data Service environment web page, select the application launcher in the top left corner.
47
47
2. Choose **Admin** > **Admin centers** > **Azure Active Directory**
48
48
3. From the left panel, choose **Azure Active Directory** > **App registrations (Preview)**
49
49
4. Choose **+ New registration**
50
-
5. In the **Register an application** form provide a name for your app, select **Accounts in this organizational directory only**, and choose **Register**. A redirect URI is not needed for this walkthrough and the provided sample code.<br /> 
51
-
6. On the **Overview** page, select **API permissions** <br >
50
+
5. In the **Register an application** form provide a name for your app, select **Accounts in this organizational directory only**, and choose **Register**. A redirect URI is not needed for this walkthrough and the provided sample code.
51
+
52
+
> [!div class="mx-imgBorder"]
53
+
> 
54
+
55
+
6. On the **Overview** page, select **API permissions**
8. In the **Microsoft APIs** tab, choose **Dynamics CRM**
54
-
9. In the **Request API permission** form, select **Delegated permissions**, check **user_impersonation**, and select **Add permissions** <br />
55
-
10. On the **API permissions** page below **Grant consent**, select **Grant admin consent for "org-name"** and when prompted choose **Yes** <br />
62
+
9. In the **Request API permission** form, select **Delegated permissions**, check **user_impersonation**, and select **Add permissions**
63
+
64
+
> [!div class="mx-imgBorder"]
65
+
> 
66
+
67
+
10. On the **API permissions** page below **Grant consent**, select **Grant admin consent for "org-name"** and when prompted choose **Yes**
68
+
69
+
> [!div class="mx-imgBorder"]
70
+
> 
71
+
56
72
11. Select **Overview** in the navigation panel, record the **Display name**, **Application ID**, and **Directory ID** values of the app registration. You will provide these later in the code sample.
57
73
12. In the navigation panel, select **Certificates & secrets**
58
74
13. Below **Client secrets**, choose **+ New client secret** to create a secret
59
75
14. In the form, enter a description and select **Add**. Record the secret string. You will not be able to view the secret again once you leave the current screen.
60
76
61
77
<aname="bkmk_appuser"></a>
62
78
## Application User creation
63
-
To create an unlicensed "application user" in your Dynamics 365 organization, follow these steps. This application user will be given access to your organization's data on behalf of the end user who is using your application.
64
-
65
-
1. Navigate to your Common Data Service organization
66
-
2. Navigate to **Settings** > **Security** > **Users**
67
-
3. Choose **Application Users** in the view filter
68
-
4. Select **+ New**
69
-
5. Change to the **Applcation User** form
70
-
5. In the **Applcation User** form, enter the required information. The user information must not match a user that exists Azure Active Directory. <br />
71
-
6. If all goes well, after selecting **SAVE**, the **Application ID URI** and **Azure AD Object Id** fields will auto-populate with their correct values
79
+
To create an unlicensed "application user" in your environment, follow these steps. This application user will be given access to your environment's data on behalf of the end user who is using your application.
80
+
81
+
1. Navigate to your Common Data Service environment (https://*[org]*.crm.dynamics.com).
82
+
2. Navigate to **Settings** > **Security** > **Users**.
83
+
3. Choose **Application Users** in the view filter.
84
+
4. Select **+ New**.
85
+
5. In the **Application User** form, enter the required information.
86
+
87
+
1. The user name information must not match a user that exists in the Azure Active Directory.
88
+
1. In the **Application ID** field, enter the application ID of the app you registered earlier in the Azure AD.
89
+
90
+
> [!div class="mx-imgBorder"]
91
+
> 
92
+
93
+
6. If all goes well, after selecting **SAVE**, the **Application ID URI** and **Azure AD Object Id** fields will auto-populate with correct values.
94
+
95
+
> [!div class="mx-imgBorder"]
96
+
> 
97
+
72
98
7. Before exiting the user form, choose **MANAGE ROLES** and assign a security role to this application user so that the application user can access the desired organization data.
73
99
74
100
> [!IMPORTANT]
75
101
> When developing a real-world application using S2S, you should use a custom security role which can be stored in a solution and distributed along with your application.
76
102
103
+
## Enable or disable application users
104
+
When application users are created, they are automatically enabled. The default Application User form shows the **Status** in the form footer; the **Status** field can't be updated.
105
+
106
+
In an event that an application user’s status is disabled and you need to enable it, you can perform the following steps to customize the Application User form to allow update to the **Status** field. You can also use these steps to disable an application user that is no longer used.
107
+
108
+
1. Remove the **Status** field from the Application User form footer.
109
+
1. Navigate to your Common Data Service environment (https://*[org]*.crm.dynamics.com).
110
+
1. Navigate to **Settings** > **Customizations** > **Customize the System**.
111
+
1. In the left pane, select **Entities** > **User** > **Forms**.
112
+
1. Select **Application User** in the list of forms
113
+
1. Select **Footer** in the actions bar.
114
+
1. Click on the Status grid, and then select Remove in the actions bar.
115
+
116
+
> [!div class="mx-imgBorder"]
117
+
> ![Remove Status field from the Application User form](media/remove-status-app-user.png"Remove Status field from the Application User form")
118
+
119
+
1. Add the **Status** field to a new section in the body of the Application User form.
120
+
1. Select **Body** in the actions bar.
121
+
1. On the **Insert** tab, select **Section** > **One Column**.
122
+
1. Under **Field Explorer** locate the **Status** field, and drag and drop the **Status** field into the new section area.
123
+
124
+
> [!div class="mx-imgBorder"]
125
+
> ![Add Status field to the Application User form](media/add-status-app-user.png"Add Status field to the Application User form")
126
+
127
+
1. Save and publish the customizations
128
+
129
+
Now, you can navigate to the application user and update the **Status** field as required to enable or disable the application user.
130
+
131
+
> [!CAUTION]
132
+
> Disabling an application user will break all the integration scenarios that use the application user.
133
+
134
+
77
135
<aname="bkmk_coding"></a>
78
136
## Application coding and execution
79
137
80
-
Follow these steps to download, build, and execute the sample application. The sample calls the WebAPI to return a list of the top 3 accounts (by name) in the organization.
138
+
Follow these steps to download, build, and execute the sample application. The sample calls the Web API to return a list of the top 3 accounts (by name) in the organization.
81
139
82
140
1. Download the Visual Studio 2017 SingleTenantS2S [sample](https://github.com/Microsoft/PowerApps-Samples/tree/master/cds/webapi/C%23/SingleTenantS2S).
83
141
2. Update the App.config file with your app registration and server key values.
0 commit comments