Azure AD-将用户和组分配给App

Question

I'm using Azure AD:

• I've added users via Microsoft Account IDs.
• I have activated "Azure AD Premium" trial
• I've assigned each user a license

Now I want to assign users access to my Web App (A cloud service), however, I'm not seeing the "Users and Groups" tab described in this article:

Important: You will only see the Users and Groups tab once you have enabled Azure AD Premium. https://azure.microsoft.com/documentation/articles/active-directory-accessmanagement-group-saasapps/

And even demonstrated in this video: http://azure.microsoft.com/documentation/videos/configure-and-assign-groups-azure-ad/

Finally, when I go to: https://account.activedirectory.windowsazure.com/applications/default.aspx I'm not seeing any "Apps" - I assume once I've been able to assign access the Apps should show here.

EDIT:

I've found some info which looks like it is not possible to sign in to Cloud Service Web App with Azure AD using a Microsoft Account:

The Azure AD scenarios and solutions (and our code samples and sample applications) require a user account in the domain of your Azure Active Directory. If you try to sign in to the applications with a Microsoft account, such as a Hotmail.com, Live.com, or Outlook.com account, the sign in fails. http://msdn.microsoft.com/en-us/library/azure/dn151790.aspx

Code Sample:

This sample will not work with a Microsoft account, so if you signed in to the Azure portal with a Microsoft account and have never created a user account in your directory before, you need to do that now. https://github.com/AzureADSamples/WebApp-OpenIDConnect-DotNet

Is it possible to sign in using a Microsoft Account / is there a worked sample/guide?

Answer 1

Assigning users and groups to applications feature is available for pre-integrated Azure AD SaaS applications. Once a user is assigned to an app, the app's icon appears in the users access panel. In some cases assigning a user provisions an account for the user in the SaaS app.

This AzureAD capability isn't yet available for other applications (eg apps developed in-house).

Note that a user doesn't need to be assigned to an application to be able to sign-in to it. Once an in-house developed application gets registered in the directory, users in that directory can sign-in to the application. So you shouldn't block on this.

KiereH, we are considering extending assign users and groups to non-pre-integrated applications too - and give the ability to assign them to an application role at assignment. Please stay tuned.

Hope this helps.