Search code examples
azureasp.net-web-apimulti-tenant

Why switch to Azure Web app / API to Multi-tenanted is not working?


I have a Web app / API deployed on Microsoft Azure working in single tenant mode. I need to enable users from other tenants to be able to use my API.

I found this post with step-by-step guide to enable multi-tenant authentication, https://blog.mastykarz.nl/configuring-multi-tenant-authentication-azure-app-service-authentication-options/

but when I try to change Web API's Multitenanted property to Yes, it says "failed to update App ID URI application property" with following error detail:

{"errorCode":"HostNameNotOnVerifiedDomain","localizedErrorDetails":
{"errorDetail":"Host name in property identifierUris is not on any verified
 domain of the company or its subdomain."},
"operationResults":null,"timeStampUtc":"2017-01-11T00:14:37.3270764Z",
"clientRequestId":"...","internalTransactionId":"...",
"upn":"...@gmail.com","tenantId":"...","userObjectId":"..."}

Currently App ID URI holds address of my Web API (and it is working in single tenant mode as expected) https://(..).azurewebsites.net is this not correct for multi tenanted mode?


Solution

  • No. With multi-tenant apps the App ID URI has to be in a domain in your AAD. So if my AAD contains domains like test.onmicrosoft.com and company.com, then allowed URIs would be:

    You don't own the azurewebsites.net domain and thus can't use it.