Mastering Azure AD: Change Configuration for an App Registration vs. an Enterprise Application

Are you an Azure AD administrator struggling to understand the difference between changing the configuration for an app registration and an enterprise application? Look no further! In this comprehensive guide, we’ll delve into the world of Azure AD and provide you with clear, step-by-step instructions on how to modify these configurations with ease.

Understanding App Registrations and Enterprise Applications

Before we dive into the nitty-gritty of changing configurations, let’s quickly review the basics. In Azure AD, an app registration represents an application that has been registered with Azure AD. This can include web applications, mobile apps, or APIs. On the other hand, an enterprise application is an instance of an application that is provisioned and managed by Azure AD.

Key differences between App Registrations and Enterprise Applications

• Scope**: App registrations define the scope of an application, whereas enterprise applications represent a specific instance of an application.
• Management**: App registrations are managed by developers, while enterprise applications are managed by Azure AD administrators.
• Configuration**: App registrations have a broader scope of configuration options, including API permissions, platform settings, and authentication settings. Enterprise applications, on the other hand, focus on user and group assignments, as well as conditional access policies.

Changing Configuration for an App Registration

Now that we’ve established the differences between app registrations and enterprise applications, let’s explore how to change the configuration for an app registration.

Step 1: Access the App Registration

Navigate to the Azure portal (https://portal.azure.com) and sign in with your Azure AD administrator credentials. Click on the “Azure Active Directory” blade and select “App registrations” from the navigation menu. Find the app registration you want to modify and click on it.

Step 2: Update API Permissions

In the app registration’s overview page, click on “API permissions” under the “Manage” section. Here, you can add, remove, or modify API permissions for your application. For example, you might want to grant your app permission to read user profiles or access Microsoft Graph.

{
  "oauth2Permissions": [
    {
      "adminConsentDescription": "Allow the app to read user profiles",
      "adminConsentDisplayName": "Read user profiles",
      "id": "User.Read",
      "isEnabled": true,
      "type": "Scope"
    }
  ]
}

Step 3: Configure Platform Settings

In the app registration’s overview page, click on “Platform configurations” under the “Manage” section. Here, you can configure platform-specific settings for your application, such as redirect URIs, logout URLs, or CORS settings.

Platform	Configuration
Web	Redirect URI: https://example.com/callback Logout URI: https://example.com/logout
Mobile	iOS: msal{client_id} Android: msal{client_id}://auth

Step 4: Update Authentication Settings

In the app registration’s overview page, click on “Authentication” under the “Manage” section. Here, you can configure authentication settings, such as the authentication flow, token endpoint, or client secret.

{
  "signInAudience": "AzureADandPersonalMicrosoftAccount",
  "redirectUri": "https://example.com/callback",
  "tokenEndpoint": "https://login.microsoftonline.com/{tenant_id}/oauth2/v2.0/token",
  "clientSecret": "client_secret_value"
}

Changing Configuration for an Enterprise Application

Now that we’ve covered changing the configuration for an app registration, let’s explore how to modify the configuration for an enterprise application.

Step 1: Access the Enterprise Application

Navigate to the Azure portal (https://portal.azure.com) and sign in with your Azure AD administrator credentials. Click on the “Azure Active Directory” blade and select “Enterprise applications” from the navigation menu. Find the enterprise application you want to modify and click on it.

Step 2: Update User and Group Assignments

In the enterprise application’s overview page, click on “Users and groups” under the “Manage” section. Here, you can add, remove, or modify user and group assignments for your application. For example, you might want to assign a group of users to have access to your application.

{
  "users": [
    {
      "objectId": "user1_object_id",
      "userPrincipalName": "user1@example.com"
    },
    {
      "objectId": "user2_object_id",
      "userPrincipalName": "user2@example.com"
    }
  ],
  "groups": [
    {
      "objectId": "group1_object_id",
      "displayName": "Group 1"
    }
  ]
}

Step 3: Configure Conditional Access Policies

In the enterprise application’s overview page, click on “Conditional access” under the “Manage” section. Here, you can configure conditional access policies for your application, such as multi-factor authentication, device-based access, or location-based access.

{
  "conditionalAccessPolicies": [
    {
      "id": "policy1_id",
      "displayName": "Require MFA",
      "conditions": {
        "users": ["user1@example.com", "user2@example.com"]
      },
      "controls": ["mfa"]
    }
  ]
}

Conclusion

In this article, we’ve explored the differences between changing the configuration for an app registration and an enterprise application in Azure AD. By following the step-by-step instructions outlined above, you should now be able to modify these configurations with ease. Remember to carefully plan and test your changes to ensure minimal disruption to your users.

Best Practices

• Regularly review and update your app registration and enterprise application configurations to ensure they align with your organization’s security and compliance policies.
• Use Azure AD’s built-in features, such as conditional access and multi-factor authentication, to enhance security and protect your users.
• Test your changes in a non-production environment before deploying them to production.

By mastering the art of changing configurations for app registrations and enterprise applications, you’ll be well on your way to becoming an Azure AD expert. Happy configuring!

1. Microsoft Azure: Register an application
2. Microsoft Azure: Quickstart: Register an application
3. Microsoft Azure: Assign a user or group to an enterprise application

Frequently Asked Questions

Get the scoop on changing configuration for an app registration vs. an enterprise application!