How to use Azure AD Self-Service Sign Up
Tags: azuread, security, csharp
Published: 2022-04-11 05:08:10

When we develop services such as Web API/Web App which is external facing, managing users are very important, yet tedious task. One of the painful such processes is to create users to use our API. 

The good news is that Azure AD provide self-service sing up to make this process easier! Let's see how this works.

# Prerequisites

- Azure Subscription
- Postman (for easy to demonstrate)
- Azure Ad with admin privilege 

# Register application and setup self-service sign up

To use this feature, we need to use Azure AD to authenticate/authorize users. Let's register an application first.

## Register application

1\. From Azure AD, select App registrations and click "New registration".

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/7zh3dphnxz7bpnp6u3qg.png)
 
2\. Enter an application name. 

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/y6ogg7b42iqbbvqp8itx.png)
 
3\. Add web as redirect url option and set ``https://oauth.pstmn.io/v1/callback`` as its url. (This is for postman)

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/eiwg1yedatbnf087y6zg.png)
 
4\. Click register and obtain application id.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/rbobhvh75rre9lrwnqb0.png)

5\. Click "Endpoint" and note authorization endpoint (v2)
and token endpoint (v2).
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/7tmjbps7xvzncl9hn92k.png)
 
6\. From "Certifications & Secrets", create new secret and note the secret value.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/adnzrn8mbdrwfand4iwr.png)
 
## Enable Self-Service Sing Up

Next, enable self-service sing up in Azure AD.

1\. Select "User Settings" and click "Manage external collaboration settings".

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/7wxh9egljnc5h1czus8d.png)
 
2\. Toggle yes for "Enable guest self-service sign up via user flows" option and save.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/zv63tvlp4htmx0trrref.png)
 
3\. Go back to previous page and select "External Identities".

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/uplvhpeqd8vcpe4b7euc.png)

4\. Select "User flows" and add new one.
  
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/2nlti0iurqmoq2dpmth9.png)

5\. Name it and select external identities you want to support.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/9qy9juw7jjcedf6vrqen.png)

6\. Select additional properties to capture and create.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ex7dwvsg54yjw6lind40.png)
  
7\. Select the created user flow and select "Applications". Add the application you created above.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/9syj1fxx46tylvxuzco3.png)

# Test from postman

Finally, let's test from postman to see how this works.

1\. Open postman and click "Authorization" tab. Select "OAuth 2.0" for type.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/fn6usi7npn9y56cfxzd2.png)

2\. Enter appropriate value for each section which you should already know from previous steps. Set ``User.Read`` as scope.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/29mgsoanoqcx67zl33ju.png)
  
3\. Click "Get New Access Token" which will launch browser. Click "Create One" in sign in screen.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/qmq6bkzn5qjltpp6rw42.png)

4\. Sign up with preferred option. I sing up with my hotmail account.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/xq0oyd2450xofp38be29.png)
 
5\. Once an account is created, you will be asked to consent.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/356fi7fgwpj0243frfxu.png)
 
6\. Then it asks the additional properties you set in user flow.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/sxmul6f308eniuupp823.png)
 
7\. Consent to app permission. Now you should get new token. You can verify the token in jwt.io for example.

# Check in Azure AD

The user is now added in Azure AD.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/buwm0xkl42kc85s27hbx.png)

# Summary

The sign-up experience is very smooth from end user point of view, and easy to setup from developer point of view. You can use the token to further process it in your backend.