Entra ID Apps

note

“CUSTOMER.com” must be replaced with your own URL and is only an example of a domain.

An application must be registered in the Entra ID (formerly: Azure AD). A "Single tenant" registration is usually sufficient, only if the installation is to be accessible for several Entra IDs, "Multitenant" must be activated.

warning

ACHTUNG
Personal Microsoft accounts are not supported.

Entra ID App Creation

For the redirect URI, select "Web" as the platform and choose such a URL:

https://CUSTOMER.com/ids/oidc-signin-office365auth

“http://CUSTOMER.com” stands for the destination address at which primedocs will later be accessible.

Application (client) ID and Directory (tenant) ID

After creation, the Overview page of the app registration shows two GUIDs that later go into primedocs.config:

Value on the "Overview" page	Use in primedocs.config
Application (client) ID	clientId in the office365Auth node
Directory (tenant) ID	{TENANTGUID} in the authority of both nodes, that is https://login.microsoftonline.com/{TENANTGUID}

The Object ID on the same page is not needed. Which value goes where is shown in the table under primedocs.config › Values from the app registrations.

Entra ID App Authentication

After creation, add the following configuration:

The following must be listed in Redirect URIs:

https://CUSTOMER.com/ids/oidc-signin-office365auth
https://CUSTOMER.com/datasourceadminapp/office365adminconsent

In Front-channel logout URL:

https://CUSTOMER.com/ids/

Activate in “Implicit grant and hybrid flows”:

• Access tokens
• ID tokens

Entra ID Certifications and secret

Then create a client secret under Certificates & secrets. Select a sufficient validity, as this secret will later be stored in primedocs.config and must be kept up to date.

After creating it, copy the content of the Value column and store it safely. This value goes into the office365Auth node as clientSecret. It is visible only right after creation, afterwards the page shows only the Secret ID, which is not used in primedocs.config. If the value is lost, create a new secret.

Entra ID API Permissions

Give the application the following "Delegated permissions" in "Microsoft Graph":

• email
• offline_access
• openid
• profile
• User.Read

There are two modes of operation for the "Application permissions": the standard mode with application permissions and the mode without application permissions.

Standard mode with application permissions

In the standard mode, the application also receives the following "Application permissions" in "Microsoft Graph":

• GroupMember.Read.All: This authorization allows primedocs to determine a user's group memberships and to look up groups. Templates, text modules, profiles etc. can be authorized to Entra ID groups in primedocs. This authorization is required to find out whether a user is in a specific group.
• User.Read.All: This authorization allows primedocs to look up users, to search the directory in the Web Admin and to synchronize users via the Microsoft Graph.

note

If you cannot grant these "Application permissions", the SCIM interface can be used for user and group synchronization.

Grant "Consent" for this application.

note

Installations that have been granted Directory.Read.All keep working unchanged. This permission gives primedocs read access to the whole directory, GroupMember.Read.All is sufficient. The HealthMonitor points this out as information. If a required permission is missing, it names it.

Operation without application permissions

If the application is not to be granted any application permissions, this is set per datasource: in the Web Admin under Integrations › Identity Provider with the switch «Operate without application permissions». primedocs.config stays unchanged. The change takes effect after about one to two minutes and can be reset at any time. The setting has no effect on datasources with SCIM or Active Directory.

primedocs then no longer queries Microsoft Graph with application permissions. Signing in via Entra ID keeps working, and so do features with delegated permissions such as saving to SharePoint or OneDrive. The following restrictions apply, however:

• Entra ID groups don't apply. Only shares for individual users, for all users and for primedocs app groups apply. App groups whose members are Entra ID groups don't apply either.
• Searching the directory returns no results, users and groups from Entra ID can't be added. Users and groups that primedocs already knows remain searchable. New users are still created at their first sign-in.
• User synchronization via the Microsoft Graph isn't available. If such a source is configured in the user sync, it is skipped without marking the users as failed or for deletion.
• The synchronization of directory groups (group sync) is skipped. Groups get no warning and aren't deleted automatically.
• The organization synchronization doesn't reconcile the permissions of the organizational units, existing permissions stay unchanged. Structure, titles and fields are still synchronized.
• The name rule for the display name doesn't apply. Users are named as the sign-in via Entra ID reports them.
• The principal cache for group memberships isn't used. If it is enabled, the HealthMonitor points this out as information.

The HealthMonitor itself reports the operation without application permissions as information, not as an error. Through its API it reports per datasource whether the application permissions are granted, missing or deliberately not used: see Principal connector and application permissions.

warning

If the profile check runs with correction, it removes organizational units in this mode that are only authorized via Entra ID groups. Resetting the switch later doesn't restore these assignments.

note

If Entra ID groups are to apply without application permissions, the SCIM interface can be used for user and group synchronization. It is set up in primedocs.config.

Optional “Delegated permissions”:

• Files.ReadWrite.All & Sites.ReadWrite.All s required for integration in Microsoft SharePoint and Microsoft Teams (Use cases).

Additional configuration for this app registration

• Add-in SSO (silent SSO): For silent single sign-on in the Office/Teams add-ins, this registration additionally needs an SPA platform (brk-multihub://<webapp-domain>), Expose an API (scope access_as_user, Application ID URI at its default api://<client-id>), and pre-authorised client applications. The full guide is at Single Sign-On (SSO) › App registration for add-in SSO.
• groups claim: If Datasources should only be visible to specific user groups (allowedForGroups), the groups claim must additionally be configured on this registration. For details, see primedocs.config › Multitenancy mode.

---

Entra ID App DataSourceAdminApp creation

App Registration

The DataSourceAdminApp is not connected to the permissions and roles concept, but has been designed as an application to support initial configuration and operation.

In a classic OnPrem environment, for example, only the administrators would be authorized to access this application via Windows groups. In the Azure environment, we use another Entra App Registration to map this.

To do this, you register another application and enter the following as the redirect URI:

https://CUSTOMER.com/ids/oidc-signin-datasourceadmin 

Activate under “Implicit grant and hybrid flows”:

• Access tokens
• ID tokens

Also define a client secret for this application.

The Application (client) ID of this second registration and the Value of its client secret go into the dataSourceAdminAppAuth node of primedocs.config as clientId and clientSecret. The Directory (tenant) ID is the same as for the first registration.

Then also grant "Consent" for this application in the API permissions.

Enterprise Application: User Assignment

Access to the DataSourceAdminApp should be severely restricted. To do this, use the "User Assignments" option in the Enterprise Application.

Search for the app registration of the DataSourceAdminApp that you have just created and activate "Assignment required" and select the users who should have access (usually only technical persons and administrators who need to export/import packages to ensure operation).