Implement authorization with roles and groups - Microsoft Identity Platform

In this video, Kalyan explains how to implement authorization in your app using roles and groups.

Learn more: https://docs.microsoft.com/azure/active-directory/manage-apps/assign-user-or-group-access-porta #assign-a-user-to-an-app---portal

Intro, overview, and prerequisites - 0:00
What is authorization? - 2:33
App roles - 6:07
App roles for users - 7:33
App roles for apps (application permissions) - 14:53
Security groups - 20:13
Nested groups - 24:58
Application groups - 25:59

Intro
• Microsoft identity platform documentation: https://docs.microsoft.com/azure/active-directory/develop/
• Developer training series playlist: https://www.youtube.com/watch?v=zjezqZPPOfc&list=PLLasX02E8BPBxGouWlJV-u-XZWOc2RkiX
• Integrating apps and securing web APIs with ID Plat
• Permissions and consent framework: https://docs.microsoft.com/azure/active-directory/develop/consent-framework
• Authentication vs authorization: https://docs.microsoft.com/azure/active-directory/develop/authentication-vs-authorization

Roles
• How to: Add app roles in your application and receive them in the token: http://aka.ms/approles
• Assign a user or group to an enterprise app in Azure Active Directory: https://docs.microsoft.com/azure/active-directory/manage-apps/assign-user-or-group-access-porta #assign-a-user-to-an-app---portal
• Delegate app registration permissions in Azure Active Directory: https://docs.microsoft.com/azure/active-directory/users-groups-roles/roles-delegate-app-roles
• Code sample: Add authorization using app roles & roles claims to an ASP.NET Core web app: https://github.com/Azure-Samples/active-directory-aspnetcore-webapp-openidconnect-v2/tree/master/5-WebApp-AuthZ/5-1-Roles
• Scenario: Protected web API: https://docs.microsoft.com/en-us/azure/active-directory/develop/scenario-protected-web-api-overview
• Code sample: A .NET Core daemon console application using Microsoft identity platform: https://github.com/azure-samples/active-directory-dotnetcore-daemon-v2

Groups:
• Configure group claims for applications with Azure Active Directory: https://docs.microsoft.com/azure/active-directory/hybrid/how-to-connect-fed-group-claim #configure-the-azure-ad-application-registration-for-group-attributes
• Configure the Azure AD Application Registration for group attributes: https://docs.microsoft.com/azure/active-directory/hybrid/how-to-connect-fed-group-claim #configure-the-azure-ad-application-registration-for-group-attributes

Final slide:
• Microsoft identity platform’s permissions and consent framework: https://www.youtube.com/watch?v=toAWRNqqDL4
• How to protect APIs using the Microsoft identity platform: https://www.youtube.com/watch?v=IIQ7QW4bYqA
• Azure Active Directory app manifest: https://docs.microsoft.com/azure/active-directory/develop/reference-app-manifest
• Azure AD Connect sync: Understanding Users, Groups, and Contacts: https://docs.microsoft.com/azure/active-directory/hybrid/concept-azure-ad-connect-sync-user-and-contacts
• Configure Microsoft 365 Groups with on-premises Exchange hybrid: https://docs.microsoft.com/exchange/hybrid-deployment/set-up-microsoft-365-groups
• Azure Active Directory pricing: https://azure.microsoft.com/en-us/pricing/details/active-directory/

► Subscribe to Microsoft Security on YouTube here: https://aka.ms/SubscribeMicrosoftSecurity

► Follow us on social:
LinkedIn: https://www.linkedin.com/showcase/microsoft-security/
Twitter: https://twitter.com/msftsecurity

► Join our Tech Community: https://aka.ms/SecurityTechCommunity

► For more about Microsoft Security: https://msft.it/6002T9HQY

#Identity #AzureAD #AuthorizationRoles