App Identity
Goal: Give the apps you deploy a directory to sign people in, and decide what each person may do in them.
Sign-in for your own apps. "The directory that signs users in to the apps YOU deploy on this platform: an Azure AD B2C directory, or your company's own Azure AD. This does not change how anyone signs in to Open Industrial."
Before you start
- A connected cloud and a provisioned private landing zone. Until both exist the menu has no App Identity. The directory's client secret is kept in the landing zone's Key Vault.
- For the guided setup, a Microsoft sign-in that reaches your Azure subscription. The manual form does not need one.
- To change anything here you are the workspace owner or hold
Workspace.Access.Manage(see Rights).
What the window shows
The hero reads Configured once a directory is complete, otherwise Not configured. Below it, the window follows the last save live, then four tabs:
| Tab | What it holds |
|---|---|
| App Identity | Your directories: set one up, open one, connect apps to it |
| Access Rights | The rights your apps check, such as samples:receive |
| Configurations | Named bundles of access rights - the access a person can hold |
| Access Cards | The people in your directories, and the configuration each one holds |
The last three are disabled until a directory is complete, and say Configure App Identity first. Access Cards says Attach a directory first when a directory exists but is not whole yet.
On every workspace, a fifth tab, Platform apps, holds OpenX's own Entra apps in the workspace's company directories. It is where the owner accepts the OpenX AI app an AI proposed; see OpenX AI App.
Set up a directory
The App Identity tab lists your Directories, each with its kind (Azure AD B2C or Company Azure AD), its state (Ready or Needs setup) and Open. Add directory starts a new one; ← All directories brings you back.
The guided setup starts with Which kind of directory?:
| Choice | What happens |
|---|---|
| Azure AD B2C | Create a new B2C directory in your connected subscription (an Azure resource that bills), or point at one you already have |
| Company Azure AD | Choose your company directory from the ones your sign-in reaches |
Then Approve once in Azure, for the management app, and OpenX registers the sign-in app and reads it back.
The manual form
Before you fill this in lists what you must do in the Azure portal first. Then:
| Field | What it is |
|---|---|
| Provider Lookup | Your name for this directory. Set when it is created |
| Display Name | How it is shown |
| Tenant ID | The directory. Set when it is created |
| Domain | B2C only, for example contoso.b2clogin.com. Set when it is created |
| Policy Name | B2C only: the user flow or custom policy, for example B2C_1_signupsignin |
| Client ID | The app registration |
| Client Secret | Write-only. Never sent back to the page. Once stored, leave it blank to keep it |
Click Save Provider (or Update Provider for a stored one).
A configured directory
Opening a complete directory shows its facts (the secret is never shown) and what you can do with it:
| Part | What it does |
|---|---|
| Sign-in web addresses | The reply URLs to add to the directory's app registration in Azure, each with Copy |
| Connect your app | Type an App name and click Connect: OpenX creates the app's identity and shows, once, the settings to add to your app's environment |
| Signing key | For an app that runs its own sign-in server, such as an MCP door: Create signing key |
| Automated job identities | Identities for jobs that call your API without a person |
| Configure for app calls | Lets apps call your OpenX API with this directory's tokens. OpenX changes the directory for you |
| Edit these details | Opens the manual form for this directory |
| Add another directory | Starts a second directory |
| Run Set up again | Shown when the directory's setup key is not stored in this workspace, so its users cannot be listed |
The client secret an app receives when you connect it is shown only once.
Access Rights, Configurations and Access Cards
| Tab | Fields and buttons |
|---|---|
| Access Rights | New Access Right: Lookup Key, Name, Description, Tags, Enabled; Save, Cancel, Delete |
| Configurations | New Configuration: Lookup Key, Name, Description, Linked Access Rights; Save, Cancel, Delete |
| Access Cards | Refresh, Find a person, and per person Choose an access configuration, Assign, and a remove mark on each card |
"People from your App Identity directories who can sign in to the apps you deploy, and the access configuration each one holds. Access follows the email, so someone found in two directories is one row, and assigning gives them that access in each directory. They do not need to be team members of this workspace."
A person with no sign-in name in the directory cannot be given access here, and is listed as such.
Save and Deploy
| Action | When it takes effect |
|---|---|
| Save Provider / Update Provider | At once: the save sets the directory up in Azure, and the window follows it |
| Connect | At once: the app's identity is created and recorded |
| Configure for app calls | At once: OpenX configures the directory, then records it |
| Create signing key | On the next Deploy ("Signing key: being created on the next Deploy") |
| Access rights, configurations and access cards | When saved - no Deploy needed |
A green save means the directory is stored; the window says when setup in Azure has finished.
Rights
Everything that changes this window - saving a directory, connecting an app, creating a signing key,
configuring app calls, and changing access rights, configurations or cards - needs the workspace owner or the
Workspace.Access.Manage right. Nobody can change their own access, and the last access configuration that
grants a platform administrator cannot be removed or emptied.
Azi and agents
Azi and agents can propose a directory - its name, tenant, domain, policy, client id, scopes and reply URLs, a request to configure app calls, and a signing key for an app already connected - but never the client secret. An accepted directory proposal lands as a draft: "Everything else is already filled in. The client secret is the one value an agent is never permitted to send, so it is the only field left for you." Enter it and save.
Access rights and configurations can be proposed too; a pending one is marked Proposed in its tab, and the App Identity menu item counts them. A job identity proposal is accepted in this window, and accepting it creates or revokes the identity in your directory straight away.
Any workspace member can accept a proposal; some changes (access, licences, connected-app requests) need a management right.
Messages you may see
| Code or place | Message |
|---|---|
PRIVATE_LANDING_ZONE_REQUIRED | "This needs a private landing zone, which this workspace does not have yet." |
| Saving without the right | "Only a workspace owner or an access admin can manage connected apps." |
ACCESS_MANAGE_REQUIRED | "Only the workspace owner or someone with the 'Workspace.Access.Manage' right can change a user's access." |
SELF_GRANT_REFUSED | "You cannot change your own access. Ask another access admin to make this change." |
| Connecting with no landing zone vault | "This workspace has no landing zone yet, and the app reads its settings from the landing zone Key Vault. Provision one in Environment, then connect the app." |
| Connecting after the sign-in expired | "Your Azure sign-in has expired. Sign in again and connect the app." |
| The form | A B2C directory needs its tenant, domain and policy together; a company directory has no domain or policy; a new directory needs its client secret |
Next steps
- Use a directory's tokens for API calls -> API Manager
- The app the AI's Azure sign-in uses -> OpenX AI App
- Who accepts what -> Team Review & Access Rights
- The order things unlock in -> Environment