Multi-tenant Azure application with anonymous access

(0) Share

Report

Posted on by ChristianCRM

Hi, I am in need to develop an application for a client. The app should interface with Dynamics 365 (online) and update some records. I already have experience in deploying web apps in azure and update records using the web api with Application User authentication.

The app will react to the creation of some type of record in crm and generate a unique url that anonymous users can access by navigating to it. There will be a UI that will allow such users to input data and update the record in Dynamics. The key part here is that users are anonymous (meaning that they should not be required to authenticate).

The first problem here is that, we don't want to deploy the application in the customer tenant but rather keep it in our tenant. I have achieved the above scenario in the past by deploying the application directly on the customer tenant but this is problematic from a maintenance perspective. Also it makes the application non-distributable, so if another customer will want the same, it will be a brand new app do create for them. I know this can be achieved with multi-tenant applications, but there is the problem of anonymity (see below).

The second problem is that multi-tenant application will require users to sign in using their credentials. The customer requires anonymous access to the data via a trusted user account, is this possible using multi-tenant applications?

I have read though this thread and it achieves everything I want except for the anonymous part. https://community.dynamics.com/crm/f/microsoft-dynamics-crm-forum/212493/ms-dynamics-crm-web-api-using-azure-ad-multi-tenant-app?pifragment-108753=2#responses

Please let me know if you need more information regarding the requirements and if anything is unclear.

Thank you,

Christian

I have the same question (0)

All responses (5)

Answers (2)

Suggested answer

Johao Larios 1,795 on at

Like (0)

Report

RE: Multi-tenant Azure application with anonymous access

Hello there,

I think that what you should do is managing your anonymous part separately from the D365 interaction:

1)Write your application that interacts with CRM.

2)On this application have a different class of objects that will be filled with the CRM information.

3)Expose to your customers this new objects, so they interact with this.

So, my idea is that you can have like a little integration software to manage this. You can perform the connection to CRM using your tenant and OAuth authentication. https://docs.microsoft.com/en-us/powerapps/developer/common-data-service/authenticate-oauth

Was this reply helpful? Yes No
ChristianCRM 5 on at

Like (0)

Report

RE: Multi-tenant Azure application with anonymous access

Hi Johao,

Thanks for your reply.

I'm not sure I get the full picture. The idea is to host the application in our tenant so we can manage the code in a single place. The application will then need permission from other tenants (our customer) to access their CRM systems.

From there unique urls to certain records will be generated and shared with users that are not part of either org (hence they're anonymous) and they are allowed to input some data that will be stored in the issuer CRM (the customer).

Is this achievable with what you said above or are there solutions?

Could you provide more details on how to create a simple concept to test this?

Was this reply helpful? Yes No
Verified answer

Johao Larios 1,795 on at

Like (1)

Report

RE: Multi-tenant Azure application with anonymous access

Hello Christian,

You can use the applicationId as I mentioned in scenarios Tenant to Tenant.

I'm thinking that what you could develop is an app to manage the connections. First, you could do the connection to CRM, and then retrieve the data needed, create new objects from this data and expose this objects through some webservice to the anonymous clients.

Then, using this webservice you could receive the data, then transform this data to CRM objects and send them to the CRM using the applicationid to connect.

hope this clarifies more what I'm trying to explain.

Was this reply helpful? Yes No
Verified answer

sdfasdf 840 on at

Like (1)

Report

RE: Multi-tenant Azure application with anonymous access

I believe this very scenario can be achieve, however there are some challenges you'll have to consider.

Since you'll have a single application that will connect to different organizations (depending on the issuer), you'll need to identify the issuer's organization you'll need to connect to.

Not only that, but you'll have to maintain a list of Application IDs and Client Secrets -- I understood from your notes that you'll use an Application User to perform action in D365, Application ID and Client Secret will be required for each different org.

If those are considered, I don't see why you would not be able to implement such an approach.

Hope it helps

Was this reply helpful? Yes No
ChristianCRM 5 on at

Like (0)

Report

RE: Multi-tenant Azure application with anonymous access

Great, that was the missing piece I could not think of. Thank you both for your answers

Was this reply helpful? Yes No