开发Azure托管Angular应用需客户提供Azure AD相关信息的技术问询

Hey folks, let's lay out exactly what info you need to collect from your client to integrate their Azure Active Directory (Azure AD) with your Angular app hosted on Azure. This structured list will make it easy for both you and the client to get everything sorted without confusion:

Core App Registration Credentials #

• Azure AD Tenant ID: This is the unique identifier for your client's specific Azure AD tenant. Your Angular app needs this to know exactly which directory to authenticate users against—you'll plug this into your auth config (like auth-config.ts) as the tenant value.
• Client ID (Application ID): This is the unique ID tied to the app registration your client will create (or may already have) for your Angular app in their Azure AD tenant. It's the key that links your app to their user directory.
• Redirect URI: The URL where Azure AD will send authentication responses back to your app. Since you're hosting on Azure, this will be your app's production URL (e.g., https://your-angular-app.azurewebsites.net/auth-callback). Make sure your client adds this URI to the "Authentication" section of the app registration.
• Post-logout Redirect URI: The URL users land on after signing out of your app. Use your app's production root (like https://your-angular-app.azurewebsites.net) or a dedicated logout confirmation page. Your client needs to add this to the app registration too.

Permissions & Consent Setup #

• Required API Permissions: If your app needs to access data via Microsoft Graph (like user profiles) or other internal APIs, list the exact permissions you need (e.g., User.Read for basic user info). Your client will have to grant these permissions in the app registration—either admin consent for all users, or let individual users consent when they first log in.
• Consent Preference: Ask the client whether they want to enable admin consent upfront (so users don't see a consent prompt) if your app requires permissions that need admin approval.

Optional (But Useful) Settings #

• Account Access Scope: Confirm if the app should only allow users from the client's specific tenant (single-tenant) or any Azure AD/Microsoft account users (multi-tenant). This changes the authority value in your auth configuration.
• Client Secret (If Needed): If your app has backend services that need to authenticate with Azure AD using client credentials (not just user context), you'll need a client secret generated from the app registration. Note: Pure frontend Angular apps usually don't need this—stick to PKCE-based client-side authentication instead.

A quick heads-up: If your client isn't familiar with Azure AD app registrations, you can give them a quick walkthrough outline: Log into the Azure Portal, go to Azure AD > App Registrations > New Registration, enter the app name, select the account type, add the redirect/post-logout URIs, and save the Tenant ID and Client ID for you.

内容的提问来源于stack exchange，提问作者Tam