microsoft entra - creating client credential client
To create a client credential login with microsoft, we can goto Microsoft Entra -> App Registration and create new app registration. Provide a name to your client for example "my-client-credential-registration" and click register.
Configure your client API permission
Goto API Permission (not Expose an API) and then
1. Grant admin consent for default directory
2. Add Microsoft Graph permission and select Application permission. It is stated there that this is for application running as background task.
Then select "User.Read.All" permission. You should have the following configuration. This settings here is what define your JWT scope.
Please remember to Grant Admin consent permission otherwise the scope or permission you specify will not appear.
3. Next create a secret for your client. So we go to "Certificate and secret". Then we will create a secret.
That's it for setup part.
Testing it using postman.
Fire up your postman and then goto App Registration Endpoints. We are trying to get access to token endpoint
Next copy the "OAuth 2.0 token endpoint (v2)" - which looks like "https://login.microsoftonline.com/your-tenant-id/oauth2/v2.0/token"
Goto postman -> Under "Authorization" select client credentials. Then fill in the following fields.
Please note for client id - we are using the Guid of the client
And finally we would have this configuration here:-
And you should get a jwt from this with a default expiry of 60 minutes.
More about configuration application permission
On the other hand if you trying to add other permission and this permission must support "Application permission" for example "Azure Healthcare APIs" and we grant it "system.all.all" then in our request we would also need to scope accordingly.
So you need to specify the scope that you wanted to appear.
Don't forget the audience will be https://fhir.azurehealthcareapis.com instead of https://graph.microsoft.com/.default.
Comments