> For the complete documentation index, see [llms.txt](https://docs.advantys.com/workflowgen-for-azure/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.advantys.com/workflowgen-for-azure/7.21.0-5/azure-active-directory-configuration-for-mobile-apps.md).

# Azure AD Configuration for Mobile Apps

## Overview

Mobile applications must use an approach similar to that of regular web applications, which is called **Authorization Code Flow with Proof Key for Code Exchange (PKCE)**. The main difference between this and the classic Authorization Code Flow is that the mobile application doesn't get a client secret, but instead exchanges a pair of codes to prove the origin of the authentication attempt. The issue is that a mobile application can't be trusted with a client secret because it's distributed directly to users and is therefore no longer under the developer's control, and the sources can be decompiled and analyzed to find secrets like this.

This section provides instructions on how to configure Azure AD for mobile apps so that your mobile users can benefit from delegated authentication as well.

For instructions on how to generate a universal link to simplify the Azure AD login process for your users, see the [Generating a Universal Link for WorkflowGen Plus](/workflowgen-for-azure/7.21.0-5/generating-a-universal-link-for-workflowgen-plus.md) section.

{% hint style="warning" %}
WorkflowGen Plus **will not work** with a WorkflowGen server that is configured to call third-party APIs with OpenID Connect (e.g. using a custom audience and/or multi-scopes).
{% endhint %}

## Prerequisites

* Make sure to have a licensed copy of WorkflowGen installed and running on a server.<br>
* Make sure to have administrative access to Azure AD to be able to configure it properly.<br>
* Make sure to have provisioned an existing Azure AD user with which you can authenticate to WorkflowGen so that you can use the application afterwards.<br>
* Make sure to have successfully configured delegated authentication to Azure AD on your WorkflowGen instance following the instructions in the [Azure AD Authentication](/workflowgen-for-azure/7.21.0-5/azure-active-directory-authentication.md) section.

## Azure Active Directory configuration

This configuration is done in three steps. First, you have to register a new native application in Azure AD. Then, you have to give the application the necessary permissions to access the WorkflowGen GraphQL API. Finally, you have to register the correct callback URLs that will redirect within the native application.

### Step 1: Register a new native application

1. In the Azure portal, click **App registrations** in the **Azure Active Directory** section.<br>
2. Click **New registration**, and fill in the properties:<br>
   * **Name:** `WorkflowGen Plus` <br>
   * **Supported account types:** `Accounts in this organizational directory only`

     \
     ✏️ **Note:** Depending on the context, you should choose the right option for your use case for the supported account type value.<br>
   * **Redirect URI**:
     * **Type:** `Public client/native`
     * **Value:** `workflowgenplus://auth.authorize/azure-v1`

       &#x20;
3. Click **Register** at the bottom of the page.

You should now see the WorkflowGen Plus registered application's overview page.

### Step 2: Grant access to the WorkflowGen GraphQL API

1. Click **API permissions**.<br>
2. In the **API permissions** section, click **Add a permission**.<br>
3. Click **My APIs**.<br>
4. Click on the WorkflowGen server application that you have previously registered.<br>
5. Click **Delegated permissions**, then select **user\_impersonation**.<br>
6. Click **Add permissions** at the bottom of the page.

### Step 3: Add the necessary redirect URIs

1. Click **Authentication**.<br>
2. In the **Redirect URIs** section, add the following items:<br>
   * Mobile authentication endpoint:
     * **Type:** `Public client/native`
     * **Redirect URI:** `workflowgenplus://auth.authenticate/azure-v1`<br>
   * Mobile logout endpoint:
     * **Type:** `Public client/native`
     * **Redirect URI:** `workflowgenplus://auth.deauthenticate/azure-v1` <br>
3. Click **Save**.

{% hint style="success" %}
You've now successfully registered the WorkflowGen Plus mobile application to your Azure AD.
{% endhint %}

### Review the registration

Take note of the information you'll need later on:

* The application's client ID, which you can find on the registration's overview page as the **Application ID**.<br>
* Your directory's tenant ID, which you can find in the Active Directory section's property sub-section as the **Directory ID**.

You'll need to give these IDs to the users who will be using the mobile application. Delegated authentication won't work unless they copy the IDs into the app.