Hide Azure application for a set of users/groups

Question

We have the following setup:

• Azure as IAM for all employees
• we are building a new portal as an entry point for all the employees since the azure standard portal is not flexible to customize look and feel and UX
• This new portal is website is directly accessible via appLink.company.com
• once you access this "portal A" you have access to plenty of other application AppX AppY AppZ, also these applications are authenticated through Azure
• Normally the users can access all the apps through myapps.microsoft.com, including PortalA AppX AppY AppZ
• Recall that all these users have permissions to the applications

However, now we are deploying incrementally this portal to a set of groups of people so we will have two sets of users:

1. set A: Users who will not have access to portalA and still need to go through myapps.microsoft.com to access AppX AppY AppZ
2. set B: Users who will have access to portalA and NO NEED go through myapps.microsoft.com to access AppX AppY AppZ

We want to force the set B of users to access PortalA (appLink.company.com), the easiest setting would be to hide all the applications on myapps.microsoft.com, making the only way to access is through PortalA, however, the limitation in Azure is that once you set the visibility of an application to false, it is hidden for all users, and you cannot apply visibility per Groups / Users

Thus we are stuck and cannot proceed with Alpha/Beta testing and piloting with a subset of users with an incremental deployment due to the limitation

Any solution on how to allow the same users to have access to an application but change the application visibility on myapps.microsoft.com per Users/Group?

Answer 1

my idea was to create another registration for the same app:

"Azure Active Directory" -> "Enterprise Applications" -> "+ New Application"

after this you'd be able to assign users from different groups to different instance of the app:

"Enterprise Application" -> "Add User Group"

and then you on properties you would set User assignment required? and Visible to users? to desired values for each copy of the app.

One drawback I see here is that you'll have to migrate some users to that new application instance and potentially set up groups accordingly.

I hope this makes sense - I chose to not make screenshots as I found it very hard to show sequential actions on the portal. If you do need a visual reference I am happy to add a couple pictures though

Answer 2

Note : This is more of a partial solution / workaround that may or may not meet your requirement.

Answer :

You could use the Collections Feature.

What are collections ?

• Collections are different app views you see in the My Apps portal.
• Apps can be grouped into collections per user groups or users.

You can create a collection by adding the apps that needs to be in it :

In the above example, I have created a collection named "Recommended Apps for you"

You can add the users/groups that need to be part of this collections :

When the assigned users access the MyApps Portal,they will be landing on the new collection you had created. Something like below

However / But / Although : The landing page only partially hides the other apps. The users will still be able to access all the apps through the "All Apps" tabs.

I did a exhaustive research to see whether there I can remove the "All Apps" collection - Unfortunately No, it is not possible !

Like in the example, for SET B users you can have a "Recommended" collection (which loads on accessing MyApps) -- & have a single app which will eventually redirect to your Custom App portal on a click.