Azure Active Directory
Welcome to the Azure Active Directory suggestions and feedback site! We love hearing from you. If you have suggestions, please submit an idea or vote up an idea. We are monitoring the site actively.
Thank you for joining our community and helping improve Azure AD!
Wehave a new log in experience integrated with Azure AD, and we stronglyrecommend you log in with your Azure AD (Office 365) account. If yourUserVoice account is the same email address as your Azure AD account, yourprevious activities will be automatically mapped to your Azure AD account. You can read more here for details: https://techcommunity.microsoft.com/t5/Azure-Active-Directory-Identity/Putting-customers-first-for-f...
-
Ability to Grant Permissions via API or Powershell
Azure AD allows you to create app registrations, define roles on them and give permissions to each other (as application identities). This way you can have a Web application talking to your API with its service principal and you can protect your API with roles.
Service Principal creation, role definition and permission assignment can be done through Portal, Powershell and API. But in order to make Application Permissions (which requires admin consent) work, you need someone with Global Administrator role to go to Azure Portal and click Grant Permissions button (or do the same thing via OAuth prompt on your…
114 votesThank you for the feedback! This is in the backlog and we are looking into this. We don’t have an ETA yet, but we will share once we have one. Please keep voting if this feature matters to you.
-
Need email alert option when keys are about to expire
Need email alert option when keys are about to expire
106 votes -
AD Groups in Application Owners
Would be great to be able to add groups to application owners in AD instead of only users. Scenario is to use on-prem AD synced with Azure to keep management of application roles/groups/etc on-prem for cloud hosted solutions.
Thanks!
98 votes -
Add support for webhooks when users are invited, added, removed from Azure AD + Azure AD B2B Collaboration
Currently it is not possible to receive a notification from Azure AD when a user has been invited (through B2B Collaboration) or added directly through Graph API or the portal.
60 votesThanks for the feedback! I’m moving this to the Developer Experiences section as this seems like it’s broader than B2B (includes regular user create/update). Please keep adding scenarios and votes.
/Elisabeth
-
Add CORS support for discovery and JSON Web Key Set endpoints
Adding CORS support to the following endpoints would allow them to be downloaded via a JavaScript application:
- https://login.microsoftonline.com/<tenantid>/v2.0/.well-known/openid-configuration
- https://login.microsoftonline.com/<tenantid>/discovery/v2.0/keysThe signatures for these endpoints could then be used to verify JWT's directly within the JavaScript.
43 votesThis makes absolute sense to support in order to ensure library compat, thanks for bringing this up. We are working to finish this, I’ll update this when it’s complete.
-
Managed Service Identity support for containers.
We currently are moving towards containerization of applications using service fabric. Is it possible to enable MSI extension for VM on host and then consume the service from the container?
41 votesThanks for the feedback. We will take this under review, and report back.
-
Make Azure Ad Application 'permissions to other applications' optional not mandatory
From what I understand, adding permissions in the 'permissions to other applications' section of an Azure AD Application means that any tenant administrator trying to grant access to that application using the Admin consent flow must have all the services requested. E.g. if requesting Office 365 'Read users email' permission and CRM Online 'Access CRM Online as organization users' permission the requesting tenant must have both of those Microsoft Services linked to their Azure AD.
If you don't have access to all requested services you receive the following error:
'AADSTS65005: The application needs access to a service that your organization…
26 votesThe v2 endpoint for Azure AD supports incremental/dynamic consent, by which an app requests the permissions it needs at run time, dynamically. This will allow your app to get tokens for basic scenarios first (e.g. sign in and get profile) and only get tokens for other, optional, scenarios (e.g. read and send mail as the user) later.
Be sure to review the current limitations on which services the v2 endpoint will grant tokens for, as this does work for all scenarios or all Microsoft services yet: https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-v2-limitations#restrictions-on-services-and-apis
-
Support Managed Service Identity on VMs in Azure Batch Pool
Enabling MSI for Windows VMs created by an Azure Batch Pool would allow us to use this service in Azure Data Factory .Net custom code activities running on Azure Batch.
21 votesThanks for the feedback. We will take this under review, and report back.
-
Azure AD service return code 404 without an informative error message
Frustrating issue: please see the below link.
https://blog.jetbrains.com/hub/2017/08/08/azure-ad-auth-module-support-discontinued/16 votes -
Show "Directory Extension" in portal for users and groups
My customers would love to have a easy approach to list all directory extensions for either a specific group or user with the Azure Portal. Currently they have to use PowerShell (Get-AzureADUser -ObjectId $UserId.ObjectId | Select -ExpandProperty ExtensionProperty) to list all the properties associated with the object. This seems a bit difficult for most supporters and IT pros. I would like to see the ability to list the attributes in the short term and the possibility to edit the attributes in the long term.
15 votes -
Where is application registered in Azure Active Directory?
I registered a new application in https://apps.dev.microsoft.com and afterwards it says "This application will be registered in the Azure Active Directory instance used to manage your xxxx@yyyy.zzz account." I can't see it anywhere.
How about providing a link to it instead of hiding it away where I can't find it, that is if it is even actually visible.
15 votesAlan, if I understand correctly, you are saying you cannot see the converged apps you registered on apps.dev.microsoft.com in the Azure Portal. Converged apps cannot currently be managed in the Azure Portal, even though they are registered in the Azure AD tenant listed in the message. If you would like to manage converged apps in the Azure Portal, please post that as an idea/suggestion or vote for it once the post exists.
-
Azure AD App registration limit for non-admin AD user
There is a limit to the number of App and\or Service Principal registrations a non-administrative Azure AD user can provision (250). This prevents having the creation of the APP or SP to be automated as soon as that limit is reached. Unfortunately there is no way to determine the number of objects that have been created by a particular account. No such counter is available, and the objects themselves don’t have a “CreatedBy” attribute that you could query. You do not want to assign the automation account user to be granted the Global admin role in Azure AD due to…
14 votes -
14 votes
-
Enable the option for adding # in the reply url for Angular applications
When developing angular applications etc, often the reply url would be something like https://myurl/#/callback. This is not possible today.
12 votes -
Add ability to limit a multi-tenant application to a list of specific tenant's
A parent company has multiple subsidiaries each having a separate tenant. A multi-tenant application written in house for the group can be used by each subsidiary but is not limited to only those tenants. I request that an element be added to the app manifest that would contain a list of tenants that could use/register the application.
11 votes -
Improved control of Client Secrets and Certifficates(also via PowerShell )
At the moment there is lack of control via PowerShell for the Client Secrets.
To list them up you have to use:
Get-AzureADServicePrincipal and list PasswordCredentials
If there is more than one key, they will be displayed in random order. This means that not always the active one will be presented as first.
At the moment there is possibility to see expired certs /keys under App registrations (Preview)but there is no option of sorting. Also for apps with more client secrets, value is not displayed at all.9 votes -
Add support to list directories that the user is member of
As per this thread on Stack Overflow (https://stackoverflow.com/questions/45235572/getting-all-b2b-directories-user-is-member-of/) it would be great to be able to list all directories the account is member of along with the directory name and possibly the primary domain. It would greatly make the B2B support in multitenant apps easier than it is right now.
9 votes -
It would be nice to have powershell support to access access Azure Portal -> AzureAd ->Users and groups - User settings
Currently, there exists no powershell commandlet in the MSOnline and AzureAD Module that could give me the list of user settings. It will be a really powerful commandlet. There exists, Get-MsolCompanyInformation, which only renders the partial information, but not all. The rest of the settings like ,1) Users can add gallery apps to their Access Panel 2) Guest users permissions are limited 3) Admins and users in the guest inviter role can invite 4) Members can invite 5) Guests can invite 6) Restrict access to Azure AD administration portal , are still inaccessible via powershell
9 votes -
ADAL google polymer element
google polymer project is getting real momentum for developing webapps. It would be great if we have ADAL polymer element integration.
https://www.polymer-project.org/1.0/8 votes -
Common OpenID Connect discovery endpoint should not contain invalid URL
The OIDC discovery endpoint for the common tenant ( https://login.microsoftonline.com/common/.well-known/openid-configuration ) has an invalid URL as the issuer attribute. The issuer must a valid URL, but it contains curly brances: 'https://sts.windows.net/{tenantid}/'. This can cause problems in libraries such as Nimbus OAuth 2.0 SDK, which parse and validate this attribute. The braces should either be URL-encoded or a different placeholder should be chosen.
7 votes
- Don't see your idea?