Creating an Azure Application for OneDrive

A new Azure Active Directory application must be created and configured to support the Data Access Security OneDrive functionality.

This configuration can be performed either by running the automated PowerShell script supplied with the SailPoint distribution pack, or by creating and configuring the application through the Azure portal.

Creating and Configuring the Application Automatically

The script below will perform all the Azure application creation and configuration steps required for OneDrive.

To run this script, the Azure AD PowerShell module must be installed.

Open PowerShell as an Administrator.
Install the Azure AD PowerShell module: Install-Module -Name AzureAD

Open the CreateSharePointOnlineAndOneDriveApp.ps1 file in a text editor to review the default parameters. The parameters can be edited in the file or passed as parameters when running the script.

CreateSharePointOnlineAndOneDriveApp.ps1

# Configures Azure Application for use as File Access Manager Exchange Online Application:
#   Creates Exchange Online App  with 'Exchange.ManageAsApp' API permission.
#   Creates and uploads certificate as app client credential.
#   Assigns application to directory role.
#   Prompts for application admin consent.
#
# NOTE: Must install Azure AD Powershell before running this script:
#   Install-Module -Name AzureAD
param(
   [string]$AppName = 'Exchange Online FAM App',
   # Available directory roles: Compliance Administrator, Exchange Administrator, Global Administrator
   [string]$DirectoryRole = 'Compliance Administrator', 
   # DnsName will be included in Cert subject name
   [string]$CertDnsName = 'organization.com',
   [int]$CertYearsValid = 10,
   [Parameter(Mandatory=$True)]
   [Security.SecureString]$CertPassword
)

Connect-AzureAD

## Get the Office 365 Exchange Online API details.
$api = (Get-AzureADServicePrincipal -Filter "AppID eq '00000002-0000-0ff1-ce00-000000000000'")

## Get the API permission ID
$permission = $api.AppRoles | Where-Object { $_.Value -eq 'Exchange.ManageAsApp' }

## Build the API permission object (TYPE: Role = Application, Scope = User)
$apiPermission = [Microsoft.Open.AzureAD.Model.RequiredResourceAccess]@{
   ResourceAppId  = $api.AppId ;
   ResourceAccess = [Microsoft.Open.AzureAD.Model.ResourceAccess]@{
      Id   = $permission.Id ;
      Type = "Role"
   }
}

## Register the new Azure AD App with API Permissions
$myApp = New-AzureADApplication -DisplayName $AppName -ReplyUrls 'http://localhost' -RequiredResourceAccess $apiPermission

## Enable the Service Principal
$mySP = New-AzureADServicePrincipal -AppID $myApp.AppID

## Display the new app properties
$myApp | Format-List DisplayName,AppID

## Find the ObjectID of role
$RoleId = (Get-AzureADDirectoryRole | Where-Object {$_.displayname -eq $DirectoryRole}).ObjectID

## Add the service principal to the directory role
Add-AzureADDirectoryRoleMember -ObjectId $RoleId -RefObjectId $mySP.ObjectID -Verbose

# Create certificate
$mycert = New-SelfSignedCertificate -DnsName $CertDnsName -CertStoreLocation "cert:\LocalMachine\My" -NotAfter (Get-Date).AddYears($CertYearsValid) -KeySpec KeyExchange

# Export certificate to .pfx file
$pfxFilePath = ".\$($AppName).pfx"
$mycert | Export-PfxCertificate -FilePath $pfxFilePath -Password $CertPassword

# Export certificate to .cer file
$certFilePath = ".\$($AppName).cer"
$mycert | Export-Certificate -FilePath $certFilePath

$bin = $mycert.GetRawCertData()
$base64Value = [System.Convert]::ToBase64String($bin)

$bin = $mycert.GetCertHash()
$base64Thumbprint = [System.Convert]::ToBase64String($bin)

## Upload and assign the certificate to application in AzureAD
$null = New-AzureADApplicationKeyCredential -ObjectId $myApp.ObjectID `
-CustomKeyIdentifier $base64Thumbprint `
-Type AsymmetricX509Cert -Usage Verify `
-Value $base64Value `
-StartDate ($mycert.NotBefore) `
-EndDate ($mycert.NotAfter)

## Get the TenantID
$tenantID = (Get-AzureADTenantDetail).ObjectID

## Browse this URL
$consentURL = "https://login.microsoftonline.com/$tenantID/adminconsent?client_id=$($myApp.AppId)"

## Display the consent URL
$consentURL

## Launch the consent URL using the default browser
Start-Process $consentURL

Run the script:
- To run the script with the default parameters from the directory where the script is located, run \CreateSharePointOnlineAndOneDriveApp.ps1
- To run the script while overriding some of the default parameters, like DNS Name, years of certificate validity, or application name: .\CreateSharePointOnlineAndOneDriveApp.ps1 -AppName "OneDrive DAS App" -CertDnsName "contoso.com" -CertYearsValid 15
When prompted, log in with administrator credentials to create and configure Azure applications.

The last step of the script will launch a URL to grant admin consent for the application. When you grant consent, you will be redirected to a missing localhost URL. The operation is successful if the URL for that page contains admin_consent=True.

Note

If you experience an access denied or other error in the web browser when granting admin consent, this might be a timing issue. This can be resolved by manually granting admin consent through the Azure portal. Alternatively you can copy and paste the consent URL into your browser. This is found in the script at: Consent URL:.

The following output should be gathered or noted when running the script. This information will be used to configure the OneDrive application in Data Access Security:

The App ID value in the console output.
The created certificate file <AppName>.pfx located in your working directory.
The certificate password that was entered when prompted.

Creating and Configuring the Application Manually

The following steps will create and configure an Azure application for OneDrive authentication through the Azure portal.

These steps are adapted from the Microsoft SharePoint Online documentation.

Registering the Application in Azure AD

Go to the the Azure AD portal.
Under Manage Azure Active Directory, select View.
On the Overview page, select App registrations under Manage.
On the App registrations page, select New registration.
On the Register an application page, configure the following settings:
- Name - Enter something descriptive, like "OneDrive DAS App"
- Supported account types - Verify that Accounts in this organizational directory only (<YourOrganizationName> only - Single tenant) is selected.
- Redirect URI (optional) - Leave empty
Select Register.

You will now assign API permissions to the application from this screen.

Assigning API Permissions to the Application

On the app page under Manage, select Manifest.
On the Manifest page, find the requiredResourceAccess entry.

Replace the entire requiredResourceAccess entry with the following:

"requiredResourceAccess": [
    {
        "resourceAppId": "c5393580-f805-4401-95e8-94b7a6ef2fc2",
        "resourceAccess": [
            {
                "id": "594c1fb6-4f81-4475-ae41-0c394909246c",
                "type": "Role"
            }
        ]
    },
    {
        "resourceAppId": "00000003-0000-0ff1-ce00-000000000000",
        "resourceAccess": [
            {
                "id": "678536fe-1083-478a-9c59-b99265e6b0d3",
                "type": "Role"
            }
        ]
    }
],

Select Save.
On the Manifest page, under Manage, select API permissions.
On the API permissions page, verify that both Sites.FullControl.All and ActivityFeed.Read appear on the list.
Select Grant admin consent for <Organization>. Read the confirmation dialog that opens.
Select Yes in the confirmation dialog. The Status value should now be Granted for <Organization> on both entries.
Close the API Permissions page (not the browser tab) to return to the App registrations page to generate a self-signed certificate.

Generating a Self-Signed Certificate

Create a self-signed x.509 certificate using the following PowerShell commands.

Edit parameters such as DnsName, Certificate expiration, and password as appropriate:

Create certificate

$mycert = New-SelfSignedCertificate -DnsName **"contoso.org"** -CertStoreLocation "cert:\LocalMachine\My" -NotAfter (Get-Date).AddYears(**15**) -KeySpec KeyExchange

Export certificate to .pfx file

$mycert | Export-PfxCertificate -FilePath mycert.pfx -Password $(ConvertTo-SecureString -String "**P@ssw0Rd1234**" -AsPlainText -Force)

Export certificate to .cer file

$mycert | Export-Certificate -FilePath mycert.cer

Assigning the Certificate to the Azure Active Directory Application

After you register the certificate with your application, you can use the private key (.pfx file) for authentication.

Go to the the Azure AD portal.
Under Manage Azure Active Directory, select View.
On the Overview page, under Manage, select App registrations.
On the Apps registration page, select the application you registered.
On the application page, under Manage, select Certificates & secrets.
Select Upload Certificate.
Browse to the self-signed certificate .cer file that you created when generating a self-signed certificate.
Select Add.

The certificate is now shown in the Certificates section.