[syshum]

Most likely they are talking about adding Non-Gallery Applications (Custom Applications) for SSO, the only option there is SAML

For OpenID Connect the developer has to sign up with Azure and have their app to the Gallery, you can not add a custom add yourself

Right now there are over 1100 Gallery apps using SAML, and only 500 using OpenID Connect

[hirsin]

This is inaccurate. Multi tenant apps can simply be signed into via OIDC and they're added to your tenant, if you allow it. All Microsoft apps use OIDC and are not allowed to use SAML, but SaaS app developers are not quite as far ahead.

But yes, we don't support dynamic registration of apps for eg OIDC/oauth

[tehbeard]

So no OIDC for "internal" apps?

I had thought I'd missed something when setting up some customers, and having to refactor to use SAML for SSO where we'd used OIDC for g-suite, but you're saying unless I throw it on the gallery (public app store?), It's only SAML?

[merb]

no. you register and you can either use saml or openid connect. btw. when you register your app you select if it is only for your tenant or for multiple tenants (or for microsoft accounts). your app never gets in the "public app store" unless you manually submit to. btw. this information is all public on their great docs.

[tehbeard]

> this information is all public on their great docs.

Public it may be, searchable it does not seem to be.

Every search seems to direct me towards [1] , Which is about gallery apps, and then directs me to a Table of contents entry that doesn't seem to exist (the closest I found was a tutorials page which is about connecting to a bunch of pre-existing SaaS apps, not for a "custom-developed app")

...maybe this is something where I have to burn half a week playing with Azure AD on a trial account to figure out..

[1] https://docs.microsoft.com/en-us/azure/active-directory/mana...

[hirsin]

Steps 2 and 3 are unrelated to the gallery. The gallery entry is basically a registered url that takes you to the app, to trigger a login (2) which triggers provisioning (3) in your tenant. So you can visit any app and add it to your tenant by signing into the app. Lots of folks want a gallery entry though, so that's what the docs focus on

[merb]

https://docs.microsoft.com/en-us/azure/active-directory/deve...

this is the correct link if you want to develop something with the identity platform, the other link is more or less admin documentation...

[syshum]

>yes, we don't support dynamic registration of apps for eg OIDC/oauth

Which is what I am talking about and ALOT of SaaS vendors do.

They have you go to AzureAD Go to Enterprise Applications, click "New Application" and then choose Application not found in Gallery.

When you do that, i can see no way to use anything other than SAML .

nothing in the Microsoft Docs, nor anything I can see on any portal gives the ability to for an Enterprise to Add their own Customer Open ID Connect application, you have to go through the process to add an App to the Gallery.

[hirsin]

Thanks for the feedback and experience! This is the difference between provisioning (adding an instance of an app to your tenant) and registration (Azure AD knowing your app exists). The pattern you're talking about is provisioning, and sadly yes, the manual route here is very focused on SAML. But anyone at all can register an app, and then anyone else can provision it into their tenant just by signing into it.

Will check out the docs and see what we can do, it's not good this was hard to learn.

[merb]

what are you talking? you can create openid connect applications in azure. and you need to sign up with azure one way or the other, saml 2.0 and openid connect applications actually need to have an app registration in azure which can only be created once your signed up?!

basically the app registration process for openid connect and saml is basically the same one?!

[syshum]

if I am in the AzureAD portal and go to Enterprise Applications, click "New Application" and then choose Application not found in Gallery.

When you do that, their are 3 SSO options for the new Applications, None of them are OpenID Connect

This is how 99% of all SaaS Vendors instruct people to add new Applications

[yrro]

You need to add an App Registration. The docs are pretty woeful!

[Serow225]

The naming does not help make things discoverable...