Develop Reference

Implement Microsoft single sign on only in external network

I am creating a web application which will make use of the single sign on organisation login feature on .net mvc project.
If the user is on the network I want to allow them to use the application without signing in as i wold be able to get their username with windows authentication.
If external i want to redirect them to the single sign on so they can be authenticated.
However my issue is that even if they are on the network, the application prompts them to sign in. How can i avoid this?

Based on the MICROSOFT DOCUMENTATION:-
Tenant administrators and developers often have requirements where an
application must be restricted to a certain set of users. There are
two ways to restrict an application to a certain set of users or
security groups:
Developers can use popular authorization patterns like Azure role-based access control (Azure RBAC).
Tenant administrators and developers can use built-in feature of Azure
AD.
To implement authentication in your application please refer this Microsoft Documentation:- Configure authentication in a sample web app by using Azure AD B2C.

I'd like to create a program that returns basic AzureAD information without tying it to one tenant

I'm not a C# programmer so forgive the ignorance, but I'm trying to create a program that will use the Graph API to do simple AzureAD commands, such as listing users, groups, etc. All articles that I've read on how to do this says the app first needs to be registered within AzureAD in order to do this, but I'd like this program to not be tied to that tenant. It'd prefer to just have a user authenticate to their tenant and use that access token to access Azure instead. I'd love any resources or where to begin. I tried to follow this article https://www.c-sharpcorner.com/article/write-your-first-program-using-microsoft-graph-sdk/ but it didn't work.

The correct approach is to register the app in your tenant as a multi-tenant app.
https://learn.microsoft.com/en-us/azure/active-directory/develop/single-and-multi-tenant-apps
This will allow the users to login with their tenant.
Your app can define the permissions it requires, which the other tenant users must consent to.

If you want to know Azure AD information, the tenant must be provided.
You can get the tenants for your account by calling
GET https://management.azure.com/tenants?api-version=2019-06-01
Reference:
https://learn.microsoft.com/en-us/rest/api/resources/tenants/list

ASP.NET : application creating user in any Active Directory

I am currently developping an ASP.NET web application in which the client can create, update or delete employee. My application is a saas application used by several clients in the world and I would like to add the following feature.
Once connected to my application, the client will have access to a form, where he can create an employee (name, surname, adress ...) and click on a button which will send those informations to the client active directory (for example azure active directory) and creates this user in the client's Active Directory.
To have a maximum compatibility with all the types of Active Directory used by my clients, I am looking for a "protocol" (dont know if its the right term) able to communicate (crud operations on user) with any cloud Active Directory.
I have done some researchs on internet, and I found the SCIM protocol, but this one cannot create user in azure Active Directory (https://social.msdn.microsoft.com/Forums/en-US/bfdf8d61-62d4-4238-b2bb-020e383cf854/does-azure-ad-support-crud-operations-on-users-using-scim?forum=WindowsAzureAD).
Thanks in advance for your help

Based on the description, it seems you want to implement a feature that other users when are sign-in your web application could manager the users from their Azure active directory.
If you I understood correctly, you can leverage the Microsoft Graph in the web application. And integrate Azure AD for the authentication to develop an multi-tenant application.
In this scenario, the other users who are the admin of their tenant can sign-in the web app with Azure AD account and give the consent to the app for managing the accounts for their tenants.
Here is an example that calling the Azure AD Graph from the web app for your reference:
active-directory-dotnet-graphapi-web

ASP.NET / OWIN/ ADAL Azure AD authentication with in app roles defined and assignment

I'm developing an app using ASP.NET WebAPI 2.2 that requires login via Azure AD for which I'm using ADAL/OWIN, but the app must have app specific permissions and roles that can be assigned to users who log in to it (a bit like SharePoint groups). The client can't use Azure AD groups, claims or Azure app permissions to assign rights/create groups as it is set up/maintained by a third party.
So, if the app is authenticating users against Azure AD, am I able to use the SQLRoleProvider to create/maintain a permission set and assign them to users within the app? I've searched for a while and not found anything that exactly fits my use scenario. Currently I'm thinking I may have to roll my own role provider.
EDITED for clarity.

You can use the custom role provider in Azure AD. When used, each user is given a role (or rather, place in a role) at the time the user is granted access to the application. I used this blog post to get started when creating a simple role-based mvc app for a customer:
Azure Active Directory, now with Group Claims and Application Roles.
We used this to separate between regular and admin users of an application we built.

Azure AD multitenant permissions

I have an Azure webapp that's managing it's users via Azure AD. I want the users to be able to register in my Azure AD directory to create an account (self-service), so I gave the app read-write access to the directory and setup a page using the Graph API to create the users.
Until here, everything is great. But the problem I have now is that I want to enable multi tenancy, so users of external AD directories can login to my app. This works, but I need to login as an administrator for the account because it also asks read-write access to their directory.
Is there a way to fix this? I only want read-write access to my directory to be able to create user accounts. I don't want to ask permission to touch their directory because, most probably, they wouldn't trust my app.
Thanks.

I found a quick and dirty solution: Add another app to the Active Directory. This app should be single tenant and have only permission to read and write the active directory. We can the use this app's credentials to access the Graph API and the other app's credentials to authenticate users.
I wait to see if someone has a better solution for this scenario...

sorry for the late response here. In general, an operation to create objects in a directory (like users) requires admin permissions. Also it looks like the web app you are creating uses app-only permissions, which definitely requires admin consent. In the multi-tenant case, the admin of the consenting tenant must be the one to consent to this type of app - only someone in this role really has the authority to grant consent for this level of access.
Hope the helps,

No need to use a secondary app in lieu of the authentication role - - there may be some peculiar side effects on the authenticating user anyway such as extraneous / incomplete logging, role inconsistencies, and missing system / internal references.
What are you using for login credentials for your app (TenantID etc.)?
AD is very strict in credential management, so I would go back to the app structure.
At the query level, you could make all tables entirely separate per tenant with no shared table data and include a multitenant identifier column so no one can sql inject if you were sure to include the multitenant identifier as an explicit variable.
Then in an entity model, you could inherit a multitenant interface for everyone which referred back to the tenant identifiers (as a part of EF).
This way the burden is isolated to OAuth or other libraries on top of that to take care of the third-party authentication.