Application Configuration inĀ Azure Portal for OAuth2 Account to use in Microsoft Entra

In this article

Overview

The Snaps in the Microsoft Entra ID Snap Pack require an OAuth2 account to access the resources. To authorize the OAuth2 account successfully, create and configure an application corresponding to the account as shown in the workflow.

You must complete steps one to three in the Azure Portal and the remaining steps in the Snap Account (SnapLogicĀ®Platform).

Prerequisites

An Azure account with a free subscription to create the application.

Key Steps in the Workflow

Create an Application in the Azure Portal

  1. Log in to the Microsoft Azure Portal.

  2. Navigate to Azure services > Microsoft Entra ID.

  3. Click AddĀ > App registration.

  4. On the Register an application page, specify theĀ name for registering the application and clickĀ Register. Learn more about creating an application at Quickstart: Register an app in the Microsoft identity platform - Microsoft identity platform.

ToĀ use an existing application, navigate to Portal Home > Azure Active Directory > App registrations > All applications. In the search box, specify the application name you want to use. Details on the application are displayed in the search list.

Define Permissions

  1. On the left navigation panel, navigate to Manage, selectĀ API permissionsĀ > Add a permission.

  2. On the Request API permissionsĀ window,Ā selectĀ Microsoft GraphĀ > Delegated permissions forĀ the OAuth2 User AccountĀ andĀ Application permissions for the OAuth2 Application Account.

  3. Select the required permissions from Files, Users/Groups, and Teams. Choose the minimum API permissions listed under Scopes and Permissions Required for Azure Active Directory.

  4. Click Add Permissions. You can view all the permissions added under Configured permissions.

  5. ClickĀ Grant admin consent confirmation and selectĀ Yes.

Ā 

  1. In the navigation panel, clickĀ OverviewĀ andĀ select Add a Redirect URI. You will be redirected to the Platform configurations page.

    1. UnderĀ Platform configurations,Ā clickĀ Add a platform.

      The Configure platforms window displays.

      Ā 

    2. SelectĀ Web and specify the Redirect URI in the following format:Ā 
      https://<control-plane-name>.snaplogic.com/api/1/rest/admin/oauth2callback/<snap-pack-name>
      where the <control-plane-name> corresponds to the domain part of your SnapLogic URLā€”elastic (global control plane) or emea (EMEA control plane).
      For example:
      https://emea.snaplogic.com/api/1/rest/admin/oauth2callback/azureactivedirectory
      https://elastic.snaplogic.com/api/1/rest/admin/oauth2callback/azureactivedirectory

    3. ClickĀ Configure. A popup message displays indicating that the application is successfully updated.

  2. On the Platform configurations page, click Save. The Redirect URIs are added in the application.

Locate the Application Credentials in the Azure Portal

To authorize your account in SnapLogic, you must have the following application credentials:

  • Application (Client) ID

  • Directory (Tenant) ID

  • Client secret value

  1. On the application page, navigate to Overview.

  2. Under Essentials, note the Application (client) ID andĀ Directory (tenant) ID needed for the Snap account.

  3. In the navigation panel, select Manage > Certificates & secrets.

  4. On the Certificates & secrets page, click + New client secret.

  5. In the Add a client secret window, enter the Description, select an option for Expires from the dropdown list, and clickĀ Add.Ā 

    The Client secretĀ value and Secret ID areĀ generated.Ā This value and ID are required to configure the OAuth2 account.

You can copy the Client secret value only after it is generated.

Scopes and Permissions Required for Azure Active Directory

Application permissions

Application permissions

Permission

Display String

Description

Admin Consent Required?

Directory.Read.All

Directory.Read.All

Allows the app to read and write data in your organization's directory, such as users and groups, without a signed-in user. Does not allow user or group deletion.

Yes

Directory.ReadWrite.All

Directory.ReadWrite.All

Allows the app to read and write data in your organization's directory, such as users and groups, without a signed-in user. Does not allow user or group deletion.

Yes

Specify the Credentials And Validate the Snap account

  1. Navigate to the Snap of your choice and configure the OAuth2 account with the details from the Azure portal's registered application. Refer to Azure Active Directory OAuth2 account

  2. Select theĀ Auto-refresh tokenĀ checkbox in the account settings and clickĀ Apply.

  3. ClickĀ Authorize. The Access and Refresh tokens are generated. You will be redirected to the sign-in page of the Azure Portal.

  4. Sign in to Azure Portal with valid credentials to redirect to the Snap Edit account settings dialog. The Access and Refresh tokens are auto-populated but encrypted in the Account settings.

  5. Validate the Snap Account.

Troubleshooting

Common Errors

Reason

Response

Common Errors

Reason

Response

Error 401

Token is invalid

Provide a valid token and reauthorize the account.

The redirect URI specified does not match the reply URI configured for the application.

Incorrect redirect URI specified by user.

Add the following redirect_uri:
https://elastic.snaplogic.com/api/1/rest/admin/oauth2callback/azureactivedirectory.

URL error when invoking the operation

Ensure the tenant domain name is correct.

Ensure that Directory (tenant) ID noted from the application is in the correct format.

Example: 2060aafa-89d9-423d-9514-eac46338ec05

Frequently Asked Questions

Yes, you can register a new application or use an existing application in the Azure portal to create an OAuth account. Refer to the configuration documentation key flow Create an Application in Azure Portal. For more information, refer toRegister a client application in Microsoft Entra ID for the Azure Health Data Services

For any support, contact the support team. The help icon in the Snap provides referential information with the selected Snap from the application.

The Scopes and Permissions Required for Azure Active Directory specify the Delegated and Application permissions details. For any other permissions that are needed for the application, refer to Microsoft Graph permissions reference - Microsoft Graph

You can use the Microsoft Entra ID OAuth2 account to connect Microsoft Entra ID Snaps with data sources. For more details refer to Configuring Microsoft Entra ID Accounts.

Related Content

Ā