Add/Edit/Remove users in Microsoft Entra App from a web application

Question

Background: we have a web application built on ASP.NET Core MVC hosted in an Azure App Service configured for Azure single sign-on. This app has a page which manages users (add / remove / change role). We keep this data in a SQL database and manage them with normal CRUD operations.

We are planning to use Azure AD as every user who accesses the app is present in Azure AD, so that we don’t have to keep a table in the SQL database.

Problem: currently, if I am already a user of the app, I will be able to add a new user from "manage users" page and that particular user will get access to the app. But if use Azure AD, is it possible for an existing user to give access(with a certain role) to a new user from the app without going to Azure portal?

Note: New users shouldn't be able to register by themselves to access the app.

Answer 1

But if use Azure AD, is it possible for an existing user to give access(with a certain role) to a new user from the app without going to Azure portal?

It is certainly possible to do so. As mentioned in the comments, you would need to use Graph API for that.

There are a few things you would need to do to accomplish this.

• Use Azure AD app roles: You would first want to move away from the app roles defined in your SQL database and define them in your Azure AD application. You can learn more about this here: https://learn.microsoft.com/en-us/entra/identity-platform/howto-add-app-roles-in-apps.
• Assign one or more app roles to users: You would need to assign users in your Azure AD one or more of these app roles. You can use Microsoft Graph API (or Graph SDK) for role assignment.
• Modify application to make use of these app roles: Now when your users login into the application and authorize themselves against it, you will get the app roles assigned to them in the claims. You would need to modify your application to extract these app roles from the claims and grant/deny access to the application (or parts of it) based on those roles. Please see this link for the sample code: https://github.com/Azure-Samples/active-directory-aspnetcore-webapp-openidconnect-v2/blob/master/5-WebApp-AuthZ/5-1-Roles/README.md.