When you consent ProvisionPoint into your tenant an Enterprise Application is created. By default this will be enabled for access to your users.

You can manage access via Security Groups within the app but you can also manage which users and Groups can see or use the app in Entra.

 

In the image below you can see our EU app in a tenant. If you look at the properties page there are a number of settings that can be changed.

 

 

 

The 'Assignment required' setting can be changed from No to Yes. The implications are of this setting are listed below:

1. If this option is set to yes, then users and other apps or services must first be assigned this application before being able to access it.
2. If this option is set to no, then all users will be able to sign in, and other apps and services will be able to obtain an access token to this service.
3. This option does not affect whether or not an application appears on My Apps. To show the application there, assign an appropriate user or group to the application.
4. This option only applies to the following types of applications and services: applications using SAML, OpenID Connect, OAuth 2.0, or WS-Federation for user sign-in, Application Proxy applications with Azure AD pre-authentication enabled, and applications or services for which other applications or service are requesting access tokens.
5. This option has no effect on users' access to the app when the application is configured for any of the other single sign-on modes.

The implications of changing this to Yes will mainly be seen in the API. If you use any of our example scripts you will need to use the user authentication and ensure the user has been added to the User and Groups are of the enterprise application. If not your scripts will not run. If you are using PowerAutomate the OAuth will also fail using an app registration and secret.

 

 

If you plan to limit the access using Azure you will need to add any users or Groups that should be able to access or view the App.