Azure-Samples / active-directory-dotnet-graphapi-web

A .NET 4.5 MVC web app that demonstrates how to query the Azure AD Graph API using the Azure AD Graph Client Library
82 stars 68 forks source link

Working with Microsoft accounts #26

Closed tgschulte closed 8 years ago

tgschulte commented 8 years ago

Thank you for putting this sample together. I am finding it very helpful. I am using it as a basis for an app to manage applications I am using AAD for authentication for, as per:

https://azure.microsoft.com/en-us/documentation/articles/active-directory-authentication-scenarios/

We use Microsoft accounts, now, and our users can do everything in https://manage.windowsazure.com/ we need: Adding and configuring applications, althought not as conveniently as we would like and also with a poka-yoke'd process.

As you have documented (excellent documentation and sample directions), "This sample will not work with a Microsoft account". Can you please give some hints or pointers on getting support for Microsoft accounts as it would be a significant improvement for to deliver that support.

thank you

tgschulte commented 8 years ago

Mostly I would like to know if using Microsoft Account is even possible. Since this demo states it does support them and when I see things like "Azure AD currently does not allow Microsoft accounts to use single sign-on protocols for applications. To implement Azure AD single sign-on in your application, use an organizational account." at https://msdn.microsoft.com/en-us/library/azure/Dn168860.aspx?f=255&MSPPError=-2147217396#BKMK_MSFTAcct

I start to wonder...

dstrockis commented 8 years ago

Hey @tgschulte. It's only possible today if you add the Microsoft Account as a "guest user" in the Azure AD directory that you're using. And if you're building a multi-tenant SaaS application, that account can only be added in one Azure AD directory.

I'd like to learn more about why you want to authenticate Microsoft Accounts as well as organizational accounts. Would you mind sharing? Or feel free to reach out to me via email if you prefer.

tgschulte commented 8 years ago

Thanks, Danny