Creating Application Registration for Authentication

From the "Overview" screen, record the following details which will be used later to authenticate:

8. Record the "Application (client) ID" and the "Directory (tenant) ID values for later use.

Next, we need to generate and record a client secret. The client Secret is a system generated token that will be used in your authentication flow.

To create a new Secret, in the Application Registration View, follow these steps:

9. Click on Certificates & Secrets
10. Click on New Client Secret, enter a description, then click the "Add" button.
11. Take a note of Secret Value. This will be used in your authentication flow later.

To authenticate with "User Impersonation", we will require users to first interactively authenticate with Microsoft.

In this example we will use the Web platform to allow the user to complete the authentication process using their web-browser and their Windows credentials.

To enable User Interactive Authentication, follow these steps:

12. In the App Registration view, expand the "Manage" menu and select "Authentication".
13. Click "+ Add a Platform".
14. Select "Web".

After they complete the authentication process, Microsoft needs an internet accessible URI linking back to your application so it can hand-back the authentication token for use in subsequent API calls:

15. If you are using this as part of our WorkPoint API PostMan project for User Impersonation authentication, you can add the PostMan URI as follows: In the Configure Web Task Pane, enter the PostMan callback URI below into the "Redirect URIs" field.

To allow the application to interact with your WorkPoint solution via the WorkPoint API, we need to grant it access to act on behalf of the end-user.

You can do so by following these steps:

16. In the App Registration view, expand the "Manage" menu and select "API permissions".
17. Click "+ Add a permission".

18. In the "Request API permissions" pane, select "APIs my organization uses".
19. Search for and select the "WorkPoint365 WebAPI" registration.

20. In the "Request API permissions" pane, select "Delegated permissions".
21. Select the "user_impersonation" option.
22. Click "Add permissions".

The summary screen should show that the application registration has "Delegated" access to the WorkPoint365 API registration:

When using the Application Registration to authenticate with your tenant, you need to provide it with a "scope" value.

The value that you should use can be taken directly from the properties of the Application Registration.

In the API permissions blade, review the "Configured Permissions Table":

23. In the "WorkPoint365 WebAPI" section, click on the "user_impersonation" line
24. Copy the "Scope" value from the top line of the "user_impersonation" pane. This is the scope to request during Authentication.

On completion of these steps, you should have a record of the following values that you can use in your authentication flow:

In the Application Registration view

25. In the "Application Registration" view, expand the "Manage" menu and select "API permissions".
26. Click "+ Add a permissions".
27. In the "Request API permissions" pane, select "APIs my organization uses".
28. Search for and select the WorkPoint365 WebAPI application from the results.

29. In the "Request API permissions" pane, select "Application permissions".
30. Locate and check the "ApplicationAccess" permission.
31. Click "Add permissions".

Note that on completion of the above, the permission has been requested - but is not yet granted.

If you have the correct role in your Azure Tenant to grant admin consent on behalf of your organization, the "Grant admin consent for {Tenant}" link highlighted will be available:

32. Click on "Grant admin consent for MSFT"

If this link is not available, you will have to raise a request to an authorized user in your tenant to perform this action on your behalf. The "Learn more" link on this page provides instruction on how to create a link that you can send directly to an authorized user to take them directly to an approval process.

When authenticating using Application Access, you will need to provide a "scope" value as part of the credentials.

This value can be obtained as follows:

33. In the API permissions grid, click on the row for "ApplicationAccess"
34. In the "ApplicationAccess" pane, copy the URI value.

Note that this URI value will be different if your WorkPoint Solution is on a different release ring (e.g. Production ring). The example shown in this example is from our test system.

The copied URI value needs to be adapted slightly for use in the authentication flow. Simply replace the final part of the URI "ApplicationAccess" with the value ".default" as shown below.

For example:

From: https://workpoint365.com/wp365webapitest/ApplicationAccess

To: https://workpoint365.com/wp365webapitest/.default

Keep a note of this value for use in your authentication request.

25. When prompted, confirm that you wish to grant admin consent to the Application Registration.

if successful, the Status field of the API permissions should now reflect that the permissions have been authorized:

On completion of the above, you should now have all the values necessary to authenticate using Application Access and integrate with the WorkPoint API.