box-turtle
commented
5 months ago I see there is some guidance on this in the old private repo, but I didn't see it in the new repo or public docs.
AAD App Resource Id format
AAD App resource id should comply with the following format:
https://<ISV's tenant verified domain>/<workload frontend server>/<workload backend server>/<workload id>/<optional string>- ISV's tenant verified domain - an exact match of verified domain in the publisher's tenant without any prefixes or subdomains. Learn how to add a custom domain to Microsoft Entra.
- Workload frontend server - the frontend server name as appears in the frontend URL (the additional segment in the frontend URL on top of the verified domain).
- Workload backend server - the backend server name as appears in the backend URL (the additional segment in the backend URL on top of the verified domain).
- Workload id - the workload id as appears in the workload manifest.
- At the end of the resource id there can be an optional string.
*.onmicrosoftsubdomains are not permitted in URLs.
FE and BE domains:
- Frontend (FE) and Backend (BE) URLs must be subdomains of the resource id with maximum 1 additional segment.
- Reply URL host domain should be same as the FE host domain.
Examples:
- AAD App resource id:
https://datafactory.contoso.com/feserver/beserver/Fabric.WorkloadSample/123 - FE domain:
https://feserver.datafactory.contoso.com - BE domain:
https://beserver.datafactory.contoso.com - Redirect URI:
https://feserver.datafactory.contoso.com/close
The docs make it clear that the magic string "localdevinstance" is required in the app id url for development.
e.g.
api://localdevinstance/853d9f4f-c71b-4420-b6ec-60e503458946/Fabric.WorkloadSampleIf you are creating an app registration for a production scenario do you remove that string? Any other string required?
Are you expected to use the same app registration for development and production?