How to deploy Managed Application with WebApp and single sign-on (Entra ID)

please accept answer if it has helped

Hi Deepanshu,
Thanks you for the proposal but as far as I can see this will not really solve the main issue.
I can create a powershell script that provisions and app registration and updates app configuration (or a key vault), but I cannot run this during the deployment from Azure Marketplace without creating a User Defined Identity to run the script as. So asking user upfront for creating the user defined identity is not much better than asking the user to create the app registration manually.
Running the script from the ARM / Bicep deployment would work great if it could be executed with the permissions of the user deploying from Azure Marketplace.

Kind regards,
Nicolai Petri

Hi Nicholai

I understand your concern. It seems that you want to simplify the onboarding process for your Azure Managed Application, specifically for configuring the Azure AD App Registration with the required client ID, client secret, and callback URL during deployment from the Azure Marketplace.

Indeed, executing a PowerShell script during deployment can be a viable solution, but you correctly pointed out that creating a User Defined Identity (Managed Identity) and running the script as the identity may not be an ideal user experience because it still involves manual steps.

To automate the deployment of your Azure Managed Application and the associated App Registration with Entra ID sign-in, here's an approach you can consider:

Integration with Azure Logic Apps or Azure Functions:

• You can use Azure Logic Apps or Azure Functions as part of your deployment process. These serverless services can be triggered during deployment and perform actions on behalf of the user deploying the Managed Application.

Azure Managed Application Custom Operations:

• Custom operations allow you to extend the deployment process of your Managed Application. You can define a custom operation that runs your PowerShell script, creating the App Registration and configuring it with the necessary settings.

Managed Identity for Azure Logic Apps/Azure Functions:

• Use a Managed Identity for your Azure Logic App or Azure Function to ensure secure access to Azure resources without requiring the end-user to set up a separate identity. This eliminates the need for users to create a User Defined Identity.

ARM Template or Bicep Integration:

• Integrate your Azure Logic App or Azure Function into your ARM template or Bicep file. You can call the custom operation to execute your PowerShell script during the deployment process. This allows the user to initiate the script without needing to manage identities manually.

Remember that this is a high-level overview, and the specific implementation details can be customized according to your application's requirements

And I can recommend arm template and bicep integration one

Thanks!

Hi Deepanshu,

Thanks again for the follow up. Maybe you have futher information or examples of one of the above solutions ? It looks a bit like a what ChatGPT would provide of answers, and looking into details I don't think any of above is possible. We already deploy web app with managed identity, but there is no way to grant that permissions to create App Registration during the deployment based on the security context of the user deploying the solution.

I hope I miss something here, so a real example would be grant.

Kind regards,
Nicolai Petri