What it's about

XCALLY gives the possibility to use Modern Authentication for Dynamics365 Accounts. 

Modern authentication is an umbrella term for a combination of authentication and authorization methods between a client and a server. It includes:

• • Authentication methods: Multi-factor authentication (MFA); smart card authentication; client certificate-based authentication
  • Authorization methods: Microsoft's implementation of Open Authorization (OAuth)
  • Conditional access policies: Mobile Application Management (MAM) and Azure Active Directory (Azure AD) Conditional Access

Very simplistic we can say, that with modern authentication, the client is talking to the service and getting redirected to Azure AD for authentication with the username and password or other methods like MFA.

How to set up

To activate the Modern Authentication for a new Dynamics365 Account on XCALLY, you need to: 

A. Register an application in the Azure Portal

B. Configure a new Cloud Provider on XCALLY by choosing Microsoft Azure as a service and Dynamics365 as the type

C. Authenticate the Cloud Provider Account

D. Associate the Cloud Provider with the Dynamics365 Integration Account on XCALLY

Azure AD application registration 

Registering an application in the Azure Portal, the Microsoft identity platform can provide authentication and authorization services for your application and its users.

App Registration

Follow these steps to create the app registration:

1. Sign in to the Azure portal

2. If you have access to multiple tenants, use the Directories + subscriptions filter  in the top menu to switch to the tenant in which you want to register the application

3. Search for and select Azure Active Directory (AD)

4. Under Manage, select App registrations > New registration

5. Enter a display Name for your application. Users of your application might see the display name when they use the app, for example during sign-in. You can change the display name at any time and multiple app registrations can share the same name. The app registration's automatically generated Application (client) ID, not its display name, uniquely identifies your app within the identity platform

6. Specify who can use the application, sometimes called its sign-in audience

   Supported account types	Description
   Accounts in this organizational directory only	Select this option if you're building an application for use only by users (or guests) in your tenant. Often called a line-of-business (LOB) application, this app is a single-tenant application in the Microsoft identity platform.
   Accounts in any organizational directory	Select this option if you want users in any Azure Active Directory (Azure AD) tenant to be able to use your application. This option is appropriate if, for example, you're building a software-as-a-service (SaaS) application that you intend to provide to multiple organizations. This type of app is known as a multitenant application in the Microsoft identity platform.
   Accounts in any organizational directory and personal Microsoft accounts	Select this option to target the widest set of customers. By selecting this option, you're registering a multitenant application that can also support users who have personal Microsoft accounts.

7. Don't enter anything for Redirect URI (optional). You'll configure a redirect URI in the next section

8. Select Register to complete the initial app registration

   

When registration finishes, the Azure Portal displays the app registration's Overview pane. You see the Application (client) ID. Also called the client ID, this value uniquely identifies your application in the Microsoft identity platform.

Your application's code, or more typically an authentication library used in your application, also uses the client ID. The ID is used as part of validating the security tokens it receives from the identity platform.

The Application (client) ID and Directory (tenant) ID values will be needed during the Cloud Provider Configuration phase. 

Authentication- Redirect URI

The authorization server sends the code or token to the redirect URI, so it's important you register the correct location as part of the app registration process.

A Redirect URI, or reply URL, is the location where the Microsoft identity platform redirects a user's client and sends security tokens after authentication.

Follow these steps to add a Redirect URI:

1. In the Azure Portal, under Manage, select Authentication (from the left Menu)
2. Under Platform configuration, select Add a platform
3. Under Configure platforms, select Web Applications 
4. Enter the following Redirect URI:

https://motionserverhost/api/cloudProviders/oauth2/microsoft/callback

(Replace "motionserverhost" with your motion server host value)

The Redirect URI will be needed during the Cloud Provider Configuration phase. 

MANCA STAMP

Credentials- Client Secret

Credentials allow your application to authenticate as itself, requiring no interaction from a user at runtime.

Credentials are used by confidential client applications (apps that run on servers) that access a web API. Types of credentials are Certificates and Client secrets. Will will use Client Secrets.

A client secret is a secret string value your app can uses to prove its identity when requesting a token. Also can be referred to as application password.

Follow these steps to add a Client Secret:

1. In the Azure portal, under Manage, select Certificates & secrets (from the left Menu)
2. Select Client secrets > New client secret
3. Add a description for your client secret
4. Select an expiration for the secret or specify a custom lifetime
   • Client secret lifetime is limited to two years (24 months) or less. You can't specify a custom lifetime longer than 24 months
   • Microsoft recommends that you set an expiration value of less than 12 months
5. Select Add
6. Record the secret's value for use in your client application code. This secret value is never displayed again after you leave this page.

The Client secret value will be needed during the Cloud Provider Configuration phase. 

MANCA STAMP

API Permission

Let's see how to provide a client app registered with the Microsoft identity platform with permissions-based access to the web API and access to Microsoft Graph.

Client applications typically need to access resources in a web API. Applications are authorized to call APIs when they are granted permissions by users/admins as part of the consent process. The list of configured permissions should include all the permissions the application needs. 

Configure delegated permission to Microsoft Graph to enable your client application to perform operations on behalf of the logged-in user, for example reading their email or modifying their profile. By default, users of your client app are asked when they sign in to consent to the delegated permissions you've configured for it.

1. Select API permissions > Add a permission > Microsoft Graph

2. Select Delegated permissions. 

3. Add the following permissions:

   Permission	Description
   user_impersonation	Access Common Data Service as organization users
   offline_access	Maintain access to data you have given it access to
   openid	Sign users in

4. Select Add permissions to complete the process.

Whenever you configure permissions, users of your app are asked at sign-in for their consent to allow your app to access the resource API on their behalf.

For these permissions, it is not necessary to provide the consent of an Administrator, as indicated by the column Admin consent required. 

Cloud Provider Configuration

To use Modern Authentication to authenticate Dynamics365 Accounts, you need to configure Microsoft Azure as service of the Cloud Provider on XCALLY.

Follow these steps to configure the Cloud Provider:

1. On XCALLY, under Settings, select Cloud Providers (from the left Menu)
2. Click on the button (on the lower right) and create a New Account
3. Enter the parameters of the application previously created in the Azure Portal: 
   1. Name: Enter a Name 
   2. Service: Select Microsoft Azure
   3. Type: Select Dynamics365
   4. Application Id: Insert the Application (client) ID value 
   5. Tenant Id: Insert the Directory (tenant) ID value
   6. Client Secret: Insert the Client secret value
   7. Redirect URI: Insert the Redirect URI
   8. Remote URI: Insert your Dynamics365 IP

Cloud Provider Account Authentication

With the use Modern Authentication, the Cloud Provider Account must be authenticated.  

Follow these steps to authenticate the Cloud Provider:

1. On XCALLY, under Settings, select Cloud Providers (from the left Menu)
2. Select the specific Cloud Provider Account, then click on the button
3. From the menu, select Authenticate

4. You will be redirected to Microsoft Dynamics365, where you insert your Email Credentials (Email address you will insert Email Address when creating a New Email Account, see next paragraph) and you need to accept the App access authorization

5. The Authentication to the Microsoft Identity Platform will be notified on XCALLY

Cloud Provider association with the Dynamics365 Integration Account

To use Modern Authentication for a Dynamics365 Account, you need to associate the specific Account with the Cloud Provider using Microsoft Azure.

Follow these steps to configure the Cloud Provider:

1. On XCALLY, under Integrations, select Dynamics365 Accounts (from the left Menu)
2. Click on the button (on the lower right) to create a New Dynamics365 Account
3. Select the Cloud Provider connection                                   
4. Click on Add New Dynamics365 Account

Client Secret Update 

Once generated, the Client Secret value is never displayed again neither in the Azure Portal nor on XCALLY.

To edit the Client Secret: 

• Generate a new Client Secret Value on the Azure Portal 
• Update the Client Secret Value on XCAlly: 
  1. On XCALLY, under Settings, select Cloud Providers (from the left Menu)
  2. Select the specific Cloud Provider Account, then click on the button
  3. From the menu, select Update Client Secret
  4. Enter the New Client Secret and then click on Save.