How to Authenticate using Azure Active Directory

Secure requests to the management service can be authenticated by creating an Azure AD application and using the Active Directory Authentication Library to obtain an access token from the application.

1. Add an application to Azure AD

   1. Sign in to Microsoft Azure, and then click Browse > Active Directory to go to Azure Management Portal.
   2. Towards the bottom of the left menu, click Active Directory and then click Default Directory.
   3. On the default directory page, click Applications, and then at the bottom of the menu click ADD to add a new application.
   4. Click Add an application you’re developing.
   5. Enter the name of the application, select WEB APPLICATION AND/OR WEB API, and then click the right arrow.

      

   6. Enter a URI for the application as follows, and then click the check mark.

      

   7. After the application is created, you must add permission for the application to access the Service Management APIs. Go to the page for your application, and then click Configure.

   8. In the permissions to other applications section at the bottom of the configuration page, click Add application, and then select Windows Azure Service Management API.

   9. Click Delegated Permissions: 0, and then select Access Azure Service Management.

      

   10. Click SAVE on the bottom menu.

   11. Click VIEW ENDPOINTS on the bottom menu to retrieve tenant_id in the placeholder.

       

   12. Find CLIENT ID and keys on the Configuration page of the application, and click Select duration to select duration for the key.

       

   13. Take CLIENT ID as the Username of HTTP protocol and keys as the Password of HTTP protocol to configure the credential.

   For more details, see https://msdn.microsoft.com/en-us/library/azure/ee460782.aspx#bk_ad.

2. Provide access to the application

   Because the Azure by WebServices discovery job uses Microsoft Azure Python SDK (Azure Active Directory Library for Python), you need to provide access to the application that you added.

   Using PowerShell, you can run the following:

   ### Install the Azure Resource Manager (ARM) PowerShell module from the   ### PowerShell Gallery
   Install-Module -Name AzureRm

   ### Note: If this command fails, you can install Azure PowerShell from WebPI.
   ### For details, see
   ### https://azure.microsoft.com/en-us/documentation/articles/powershell-install-configure/.

   ### Install the AzureRm child modules (this may take a few minutes)
   Install-AzureRm
   
   ### Authenticate to Microsoft Azure (an authentication dialog will open)
   $null = Login-AzureRmAccount
   
   ### List out the Microsoft Azure subscriptions available to your account
   Get-AzureRmSubscription | Format-Table -AutoSize
   
   ### Select the Microsoft Azure subscription you want to manipulate
   Set-AzureRmContext -SubscriptionId ABCDEFGH-1234-1234-1234-ABCDEFGH
   
   ### List out the Azure Active Directory (AAD) Service Principals in your AAD ### tenant
   Get-AzureRmADServicePrincipal | Sort-Object -Property DisplayName
   
   ### Assign the "contributor" role to your Azure Active Directory (AAD)    ### Service Principal
   New-AzureRmRoleAssignment -ServicePrincipalName http://PythonSDK -RoleDefinitionName Contributor

   For more details, see Microsoft Azure Active Directory Authentication Library (ADAL) for Python.