FHIR Server for Azure: Azure AD mechanism when there are multiple servers

Question

As explained here, you have to register your FHIR API with Azure AD in order to make calls to the API.

Azure AD is free for Single Sign-On for up to 10 apps: https://azure.microsoft.com/en-us/pricing/details/active-directory/

Q: Given a scenario where I have more than 10 FHIR APIs accessed through a single Web platform by multiple users, do I need to assign an account for each actor and pay $6 user/month(Premium P1)?

Or could I have a single account that is used to make calls to the APIs and authenticate the actors through another method? If you have hundreds of users it is pretty expensive to pay 6$ for each just for authentication.

Do I understand Azure AD correctly? Is there any other better method?

Answer 1

Answer: No. It's very likely you can get away with less than 10 app registrations without losing the ability to authorize each individual user. The only limit you should be worried about is the 500,000 object limit.

Explanation: The concept of App Registration is well explained here, and I won't make an attempt to do a better job.

The key thing in the context of this question is that you can use the same App Registration with as many "applications" as you want. The only consequence is that you won't be able to assign different permissions to each of those applications.

From your question is not very clear what "10 APIs" mean.

In the simplest case, you have 10 different endpoints hosted under the same application, in which case the solution is trivial: use a single app registration with as many "app roles" as necessary to control access as granularly as you need/supported by FHIR.

Worst case, you have 10 applications hosted independently, in which case you can still use the app manifest to create as many app roles as necessary, most likely using some prefixing: app1_admin, app1_readonly, app2_readonly, etc. Then use those app roles to grant permissions to your endpoints.

See this documentation about how to create app roles in your app manifest.

A picture is worth more than a thousand words. This one should illustrate how you can use the same App Registration for as many applications as you wish.