Kyle Marsh

I work with developers for the Microsoft Identity team. Been around Microsoft and developers for a while now.

[Kyle Marsh @kylemar]

@ZackKorman @NathanMcNulty @merill There will be times when you want an agent to access resources that have traditionally been assigned to users or have interactions with agents outside of the now traditional chat experience. This video shows some scenarios. https://t.co/pB3z1KJWj8

[Kyle Marsh @kylemar]

@NathanMcNulty @ZackKorman @merill Finally, Agent ID can be used in conjunction with Agent User. This is to provide a real agent user instead of creating a human user object and trying to get that to work for an agent.

[Kyle Marsh @kylemar]

@NathanMcNulty @ZackKorman @merill Agent IDs can be used in three ways. First, to enable an Agent to act on behalf of a user. Think of this is using an Agent in an On behalf Of flow. Second, to enable an agent to act on it's own behalf. This is very similar to an app using client credentials.

[Kyle Marsh @kylemar]

Just published https://t.co/tPGAab1zKI

Over the last 7 years I have worked with a lot of ISVs integrating their solutions for customers using Microsoft Entra ID. This guide covers the most common conversations I have with ISVs about building on Entra ID

[Kyle Marsh @kylemar]

Great to see Domino’s Pizza Enterprises complete migrating their apps to Microsoft Entra ID https://t.co/rmnsinz7Wg @andrescanello

[Kyle Marsh @kylemar]

@aizeekay @davidfowl Microsoft Entra External ID was introduced at Build this year. https://t.co/tAERKkLbBh

[Kyle Marsh @kylemar]

@MattP1Tommy @TommyHilfiger Sponsored by Tommy Hilfiger with a Mercedes AD and suddenly Red Bull, and mostly Verstappen, is predicted to be a flop. What are the odds the the predictions follow the money.

[Kyle Marsh @kylemar]

Lots of interesting sessions on Consumer Identity (CIAM) with Microsoft Entra at Microsoft Build next week. https://t.co/wM1kql96Dn

[Merill Fernando @merill]

I've recently noticed that Azure AD admins are being asked to create multi-tenant apps in their corporate tenant.

In some instances, it was the devs in the org asking for this, in other instances it was the application vendor.

Here are some things to watch out for 👇

Multi-tenant apps are meant for ISVs and SaaS vendors to create an instance of an app in 'their own tenant'. Examples of such apps are ServiceNow and SalesForce.

When an app is created as a multi-tenant app, ANY user from ANY Azure AD tenant can visit the app's url and sign in.

If you create a multi-tenant app in your corporate tenant and apply a conditional access policy. The policy only applies to users in your tenant.

⚠️ I'll repeat ➟ your CA policies do not apply to users signing into your multi-tenant app in their own tenant.

So, what is the general rule of thumb that Azure AD admins and cybersecurity teams should follow?

If the app is from a vendor/SaaS provider:
✅ Add the app to your tenant from the Azure AD Application Gallery
✅ If the app is not in the gallery, you as the customer can request the vendor to get their app listed on the Azure AD app gallery
✅ If app gallery is not an option, request the vendor to create the app in their own tenant. Use the admin consent model to add the app to your tenant.
✅ If the only option provided by the vendor is to create the app in your tenant, push for the vendor to allow you to create a single tenant app.

If the app is developed by devs in your org and is only meant for users in your own org.
✅ Ask why the dev needs this to be a multi-tenant app?
✅ Ask if the devs have implemented appropriate checks to prevent sign-ins from other tenants.

There are many valid scenarios for creating multi-tenant apps in your tenant, including
✅ You are a SaaS vendor or ISV and you create and publish apps that Azure AD customers can consume
✅ You manage multiple Azure AD tenants in your org and you need a single service principle (workload identity) to access the other tenants (e.g. automate DevOps tasks across your tenants)

Here are some further reading on the topic of multi-tenancy. These are meant for devs however its good reading for admins to appreciate what it takes to build a least-privilege multitenant app.

👉 https://t.co/9JRZ2ynEdZ
👉 https://t.co/VyiyiK542A

Liked this post? Please retweet this to share with your network. 🚀

Feel free to follow me. I try to post at least one weekly tip related to Microsoft Identity, Azure Active Directory or Microsoft Graph. 🙏

[Kyle Marsh @kylemar]

@TruBluDevil I am so sorry to hear this. You are inspiring in what you do and how you do it. Stay strong. Best wishes for you going forward.

[Kyle Marsh @kylemar]

@merill I like the look.

[Kyle Marsh @kylemar]

If you want to learn about migrating apps from ADFS to Azure AD, check out the 425 Show Tuesday, March 14th at 8AM PST (15:00 UTC) https://t.co/WGgKAY1REi

[Stan Marsh @StanGMarsh]

Nothing like mixing on a Friday with all the new music releases and todays no exception 🎧🤘🔥

[Stan Marsh @StanGMarsh]

Lose My Self v.3 by Stan Marsh on #SoundCloud #dj
https://t.co/lhQKhZbHsP New mix out now! Kinda messy in a few spots but is the first of many getting back in the mix 🎧😎

[Stan Marsh @StanGMarsh]

Recorded a new set to post 🎧🔥👽 it’s not perfect but am working hard at it and posting more mixes and originals. Randy was chilling next me while I did which always helps lol

[Stan Marsh @StanGMarsh]

Being productive,
While losing my train of thought..
This is a haiku :P

[Stan Marsh @StanGMarsh]

Probably spent too long playing with the new themes lol FL 21 is great so far excited to work with it 🎧🔥 #FLStudio21

[Bailey Bercik - @[email protected] @BaileyBercik]

Just got a copy of @michael_howard’s newest book! @kylemar, @markmorow, and I were happy to help out where we could to make this as good as it could be. Looking forward to reading the whole thing
https://t.co/FGaMX2y97O

[Kyle Marsh @kylemar]

@FloRugby @AllBlacks @wallabies Once again @FloRugby coverage is horrible. As AUS is one meter out, @FloRugby switches to full screen commercials and then hangs preventing watching the game anymore at all. Worst possible service. company goes out of it’s way to prevent customers getting what they paid for.