Mike Weaver

Microsoft MVP | Office 365 Technologist Specializing in Mergers, Acquisitions & Divestitures | Equality & Inclusion Advocate | Author of | He/Him

[Mike Weaver @MADMike_365]

This is a great explanation. I run into a lot of clients that demand they own & create the App Reg. This clearly explains why it isn’t usually the right decision.

[Merill Fernando @merill]

I've recently noticed that Azure AD admins are being asked to create multi-tenant apps in their corporate tenant.

In some instances, it was the devs in the org asking for this, in other instances it was the application vendor.

Here are some things to watch out for 👇

Multi-tenant apps are meant for ISVs and SaaS vendors to create an instance of an app in 'their own tenant'. Examples of such apps are ServiceNow and SalesForce.

When an app is created as a multi-tenant app, ANY user from ANY Azure AD tenant can visit the app's url and sign in.

If you create a multi-tenant app in your corporate tenant and apply a conditional access policy. The policy only applies to users in your tenant.

⚠️ I'll repeat ➟ your CA policies do not apply to users signing into your multi-tenant app in their own tenant.

So, what is the general rule of thumb that Azure AD admins and cybersecurity teams should follow?

If the app is from a vendor/SaaS provider:
✅ Add the app to your tenant from the Azure AD Application Gallery
✅ If the app is not in the gallery, you as the customer can request the vendor to get their app listed on the Azure AD app gallery
✅ If app gallery is not an option, request the vendor to create the app in their own tenant. Use the admin consent model to add the app to your tenant.
✅ If the only option provided by the vendor is to create the app in your tenant, push for the vendor to allow you to create a single tenant app.

If the app is developed by devs in your org and is only meant for users in your own org.
✅ Ask why the dev needs this to be a multi-tenant app?
✅ Ask if the devs have implemented appropriate checks to prevent sign-ins from other tenants.

There are many valid scenarios for creating multi-tenant apps in your tenant, including
✅ You are a SaaS vendor or ISV and you create and publish apps that Azure AD customers can consume
✅ You manage multiple Azure AD tenants in your org and you need a single service principle (workload identity) to access the other tenants (e.g. automate DevOps tasks across your tenants)

Here are some further reading on the topic of multi-tenancy. These are meant for devs however its good reading for admins to appreciate what it takes to build a least-privilege multitenant app.

👉 https://t.co/9JRZ2ynEdZ
👉 https://t.co/VyiyiK542A

Liked this post? Please retweet this to share with your network. 🚀

Feel free to follow me. I try to post at least one weekly tip related to Microsoft Identity, Azure Active Directory or Microsoft Graph. 🙏

[Mike Weaver @MADMike_365]

@adamj89 @msdevUK @MSFTReactor Happy to take part @adamj89 !

[Microsoft 365 Status @MSFT365Status]

We've rolled back a network change that we believe is causing impact. We're monitoring the service as the rollback takes effect.

[Mike Weaver @MADMike_365]

MADNick and I have added Roxy to our family ;). I don’t think MADRoxy works, but will see in time!

[Mike Weaver @MADMike_365]

@paulrobichaux @LastPass I am, for now, taking the stance that all of these firms are strong targets and can get hit. But one more issue and they are fired.

[Mike Weaver @MADMike_365]

When coordinating meetings across times zones, FindTime for #outlook is perhaps one of the most underutilised tools in #Office365! In this BLOG I review when & how to use it!

https://t.co/8ht4EcVmGa

[Mike Weaver @MADMike_365]

@KarenMStones Can’t wait!

[Mike Weaver @MADMike_365]

It’s afternoon tea here in London, time for that third coffee in New York, and time for a brisk morning walk in Cali. 

In one hour, CJ Gregorios and I are here at Virtual #TEC2022 with our ENI Session on Preferred Gender Pronouns For Systems Administrators!

[Mike Weaver @MADMike_365]

Sound check done! Ready for my session with Becky Cross at virtual #TEC2022!

[Practical 365 @Practical365]

Virtual TEC is this week, December 6-7! Make sure to sign up today to catch sessions by Practical 365 bloggers such as @12Knocksinna, @paulrobichaux, @MADMike_365, @JulianSStephan, and more!

Plus, it's 100% free to register!
https://t.co/Zi7wew2oBL

[Mike Weaver @MADMike_365]

@rucam365 Turn off PSTs ;)

[Mike Weaver @MADMike_365]

Well…LCY -> ZUR -> FRA -> LHR. Gets me the three segments I need way cheaper than any other option. Leave at 8:45am and land at 4:45pm. I wish I had enough time for the lounge at Zurich!

[Mike Weaver @MADMike_365]

Ugh. I am very close to maintaining Star Gold. United got rid of the PQF requirement for non-residents. Do I fly EWR to BDL to keep status? Might end in divorce where it’s the day after landing from London. It would be a amazing race with Nick as he gets the hire car!

[Mike Weaver @MADMike_365]

@uacat92 I’m looking at a non direct trip to Zurich and back the same day right now ;)

[Mike Weaver @MADMike_365]

@jsnover Husband and I both have them. We love them. The monitor arms are very good, including the laptop attachment. Highly recommend the keyboard tray so it’s at the right height whether you are standing or sitting.

[Mike Weaver @MADMike_365]

On my way to #SCS2022 with @thousandeyes ! See you all tomorrow!!

[Mike Weaver @MADMike_365]

Stop by and say hello at #MSIgnite in Manchester!

[Mike Weaver @MADMike_365]

On my way to #MSIgnite in Manchester!

[Mike Weaver @MADMike_365]

@rucam365 It really is the big conflict. For home devices I have been helping people with bitlocker to go. For so many years I forced a chip down on people, but was always hard to convince people of the price. (And rightfully so)

[Mike Weaver @MADMike_365]

The TPM Requirement for #windows11 is crap…till you see stuff like this on the way to the gym this morning. I fully support "forcing" basic security principles by default. Everyone needs local #diskencryption. If you are running Windows, this is #bitlocker for most.

[Mike Weaver @MADMike_365]

@AlanMByrne I’ll send you the family Apple Crisp recipe ;). It’s like a crumble but better!