AppId Uri in single tenant applications will require use of default scheme or verified domains

Effective date: October 2021 Endpoints impacted: v2.0 and v1.0 Protocol impacted: All flows Change For single tenant applications, adding or updating the AppId URI validates that the domain in the HTTPS scheme URI is listed in the verified domain list in the customer tenant or that the value uses the default scheme (api://{appId}) provided by Microsoft Entra ID. This could prevent applications from adding an AppId URI if the domain isn't in the verified domain list or the value doesn't use the default scheme. To find more information on verified domains, refer to the custom domains documentation. The change doesn't affect existing applications using unverified domains in their AppID URI. It validates only new applications or when an existing application updates an identifier URI or adds a new one to the identifierUri collection. The new restrictions apply only to URIs added to an app's identifierUris collection after October 15, 2021. AppId URIs already in an application's identifierUris collection when the restriction takes effect on October 15, 2021 will continue to function even if you add new URIs to that collection. If a request fails the validation check, the application API for create/update will return a 400 badrequest to the client indicating HostNameNotOnVerifiedDomain. The following API and HTTP scheme-based application ID URI formats are supported. Replace the placeholder values as described in the list following the table. Supported application ID URI formats Example app ID URIs api:// api://aaaabbbb-0000-cccc-1111-dddd2222eeee api:// / api://aaaabbbb-0000-ccc…

Permanent link to this revision