Allow SmartHub to accept authentication tokens from other Azure app registrations

• Prerequisites

• Registering the additional app for token exchange

  • Register the secondary app in Microsoft Entra ID

  • Configure API Permissions for your secondary app

• Configuring the token exchange

  • Expose API permissions for your original SmartHub app

  • Grant API Permissions for your original SmartHub app

  • Configure your secondary app to use your original SmartHub app’s API

SmartHub supports token exchange, allowing SmartHub to accept authentication tokens generated by another Azure App. There are a number of use cases in which you may want to use this functionality. For example:

• The chat UI application uses different Microsoft Entra ID app for authentication than the one that is configured in SmartHub.

• You have a token from an Azure app that you want to use, rather than obtaining a new SmartHub dedicated token.

Prerequisites

• Your SmartHub instance must already have an app registration which was created and configured in SmartHub. For more information, see set access and user authentication for SmartHub with Azure Cognitive Search.

• You must have 2 app registrations in Azure (your original SmartHub app registration and your secondary app registration), this allows your secondary app to request an access token from the original SmartHub app on behalf of a user. For more information on registering an additional app, see Registering the additional app for token exchange below.

Registering the additional app for token exchange

If you already have an existing secondary app registration, you can skip this section.

Register the secondary app in Microsoft Entra ID

1. Log in to the Azure Portal and navigate to Microsoft Entra ID.

2. In the left panel, select Manage > App registrations > New registration.

3. Complete the following:

   1. In the Name field, provide a name for your registration. For example, "Secondary app".

   2. In the Supported account types field, select an appropriate option depending on whether this will be a single-tenant or multi-tenant app.

   3. In the Redirect URI field, select a platform and enter a redirect URI. For example, https://localhost if you are testing locally.

4. Click Register.

Configure API Permissions for your secondary app

1. In the secondary app registration, go to API Permissions > Add a permission.

2. Add the required SmartHub permissions. See set access and user authentication for SmartHub with Azure Cognitive Search for more information.

3. Under Configured permissions, click Grant admin consent to allow the app to use these permissions.

4. If you are using your secondary app to request an access token from the original SmartHub app on behalf of a user, you must not add the permissions for your original SmartHub app here.

Configuring the token exchange

Expose API permissions for your original SmartHub app

1. In your original SmartHub app registration, click Expose an API.

2. Click Set to create an Application ID URI if prompted (this will be in the format api://<client_id>).

3. Under Scopes defined by this API, click Add a scope.

4. Complete the following,

   1. In the Scope name field, enter a name. For example, "access_as_user".

   2. In the Who can consent? field, select Admins and users.

   3. In the Admin consent display name field, enter a display name. For example, “Access original SmartHub app on behalf of the user.”

   4. In the Admin consent description field, enter a description. For example, “Allow "Additional app" to call "original SH" on behalf of the signed-in user.”

   5. In the State field, select Enabled.

5. Click Add scope.

Grant API Permissions for your original SmartHub app

1. In your original SmartHub app, go to API Permissions > Add a permission.

2. Select My APIs and choose your original SmartHub app.

3. Select the scope you created (e.g., access_as_user) and click Add permissions.

4. Click Grant admin consent for the added permission.

Configure your secondary app to use your original SmartHub app’s API

1. In secondary app, go to API Permissions > Add a permission.

2. Select My APIs (or APIs my organization uses).

3. Find and select your original SmartHub app.

4. Select the scope you created earlier (e.g., access_as_user) and click Add permissions.

5. Click Grant admin consent if required.

In SmartHub, your secondary app should be added under the Trusted App Registrations in the Security Configuration page.