Using Service Principal Authentication (SPA) to create custom roles

Topic

This article explains use Service Principal Authorization to create custom roles in NinjaOne SaaS Backup.

Environment

NinjaOne SaaS Backup

Description

You can use Service Principal Authorization to create custom roles in NinjaOne SaaS Backup. Review the sections below to learn how.

How do I find the SPA toggle?

1. Login to the Partner Portal
2. Go to the Organization Page
3. Select an Organization, then click "View Details"
4. The SPA toggle is available under the Features tab

What is the default value of the SPA toggle?

It will be in a disabled state.

What is the effect on the End-User Portal once the toggle is activated?

Users will be redirected to use manual custom role creation while adding M365 backup. On the other hand, when the toggle is deactivated, users will be redirected to use the automated custom role creation while adding M365 backup.

What does manual custom role creation mean when adding the M365 backup?

Manual custom role creation refers to the manual process of creating a role with minimum necessary permissions to perform backup tasks. The role is created by running a PowerShell script. In the manual flow, users must download and run the PowerShell script instead of letting NinjaOne SaaS Backup run it. 

Follow these steps to add M365 backup with manual custom role creation:

1. Log in to the End-User portal
2. Click the "+Add Backup" button on the Dashboard page.
3. Click the "Sign in with Microsoft 365" button
4. Input the M365 Global admin account accordingly
5. Click the "Accept" button
6. Once the consent is granted, the user will be redirected to the M365 AUTHORIZATION page. There are two steps in total.
   1. Step One - Create Backup Application - sub-applications are created in the user's tenant (may take a few seconds to complete)
   2. Step Two - Click the "Verify & Continue" button to complete the authorization. Please ensure you follow all three provided instructions for a successful result
      1. Download the PowerShell script by clicking the provided button
      2. Open your PowerShell command prompt, then run the script (point 2.1) until it is executed completely 
      3. A brief FAQ section has been included to further assist you in understanding the flow
7. Once authorization is successful, you will be redirected to the M365 account list page where you can start selecting mailboxes to backup.

What does automated custom role creation mean when adding the M365 backup?

Automated custom role creation refers to the automated process of creating a role with minimum necessary permissions to perform backup operations. The role is created by running a PowerShell script. In the automated flow, NinjaOne SaaS Backup will run the PowerShell script instead of letting users do so.

To add M365 backup with automated custom role creation, follow these steps:

1. Log in to the End-User portal
2. Click the "+Add Backup" button on the Dashboard page
3. Click the "Sign in with Microsoft 365" button
4. The system shows two options, select the second line to experience Service Principal Authentication (SPA). The first line corresponds to the current authorization, which still involves Global Admin creation.
5. Input the M365 admin account accordingly
6. Scroll down the page and click the "Accept" button to allow our application to be backed up
7. Once the consent is granted the user will be redirected to the M365 AUTHORIZATION page. There are two steps in total. 
   1. Step One - Create Backup Application - sub-applications are created in the user's tenant (may take a few seconds to complete)
   2. Step Two - Device Authorization - start by clicking the available link
8. The system will redirect you to the new Microsoft window, copy and paste the code from the portal, then click the "Next" button 
9. Select the correct email admin
10. Click the "Continue" button
11. Once you see this screen, device authorization is complete. You may close the window.
12. Back in the End-User portal, click the "Verify & Continue" button to finish this step
13. Once it is successful, the system will list all of the M365 Accounts on this tenant. Select the account you wish to add to the backup