Configure web app authentication

After you register the application with Microsoft Entra ID, connect the web app to the app registration, enable the managed identity of the web app, and give administrators access to the web app settings.

Configure authentication

Connect the web app to the app registration with App Service built-in authentication. For more information, refer to Configure Microsoft Entra authentication and Authentication and authorization in Azure App Service.

1. In the Azure portal, open the web app, and go to Settings > Authentication.

2. Add the Microsoft identity provider, or edit it if it already exists.

3. Select the app registration that you created.

   The Client ID is the Application (client) ID from the Overview page of the app registration. App Service generates the client secret for sign-in, and stores it in the MICROSOFT_PROVIDER_AUTHENTICATION_SECRET app setting.

4. In the Allowed token audiences field, enter the Application ID URI of the app registration.

   You can find this value on the app registration, under Expose an API. For example: api://<Application (client) ID>. For more information, refer to Allowed token audiences.

5. Click Save.

Enable the managed identity

Enable the system-assigned managed identity of the web app. The web app uses this identity to call D365 F&SCM, so no client secret, client ID or tenant ID is stored for that call. The identity is not used for user sign-in. For more information, refer to Add a system-assigned identity.

1. On the web app, go to Settings > Identity.

2. On the System assigned tab, set Status to On.

3. Click Save, and confirm with Yes.

Assign the BISAdmin app role

Users with the BISAdmin app role can change the settings of the web app. Without this role, the Edit settings button is not shown when a user browses the web app. Create the app role on the app registration, and assign it to users or groups in the enterprise application. For more information, refer to Add app roles to your application and Assign users and groups to an application.

1. On the app registration, go to App roles, and click Create app role.

2. Enter the values for the app role.

   • Display name: Enter BISAdmin.

   • Allowed member types: Select Users/Groups.

   • Value: Enter BISAdmin.

   • Description: Enter a description, for example BISAdmin role.

   • Do you want to enable this app role?: Select the checkbox.

   Note

   Enter the value exactly as BISAdmin. The web app checks for this value to show the Edit settings button.

3. Click Apply.

4. On the Overview page of the app registration, click the Managed application in local directory link.

   This link opens the enterprise application of the app registration. You assign users and groups to the app role in the enterprise application.

5. Go to Users and groups, and click Add user/group.

6. Select the users or groups that manage the web app settings, select the BISAdmin role, and click Assign.

7. If a user or group also has the Default Access role, select that assignment, and click Remove assignment.

   Keep only the BISAdmin assignment for these users and groups.

Restart the web app

Restart the web app to apply the authentication, identity and app role settings.

1. On the web app, go to the Overview page.

2. Click Restart, and confirm.