How to setup webhook for user deactivation?

Atul Pandey 0

We are building a SaaS platform for onboarding tenants. Their users can log in to our mobile app using SSO.

When the tenant's admin deactivates the user I want to receive a notification so that I can deactivate the user in my app.

I tried setting up a subscription but got this error

'PreconditionFailed': 'StartReceivingChangesOnTenant can not be initiated on a Mega Tenant for service AadGraphNotifications

What is the correct way of doing this?

1 answer

Francisco Marrero 76 Reputation points

2025-02-17T14:04:09.7566667+00:00
Setting up a webhook to receive notifications for user deactivation involves several steps. Here's a general guide to help you get started:

Create a Webhook Endpoint: You'll need a publicly accessible HTTPS endpoint that can receive HTTP POST requests. This endpoint will be where Microsoft Graph sends the notifications.

Define the Subscription: Use the Microsoft Graph API to create a subscription for the resource you want to monitor. In your case, this would be user deactivation events.

Handle the Notification: Ensure your endpoint can process the incoming notifications and take appropriate action, such as deactivating the user in your app.
Please sign in to rate this answer.
Atul Pandey 0 Reputation points

2025-02-17T14:12:04+00:00

Correct. So I have configured these things and when I was about to create a subscription from my nodejs application, I got the following error.

Exception: [Status Code: PreconditionFailed; Reason: Precondition Failed; Message : Request failed with status code 'PreconditionFailed': 'StartReceivingChangesOnTenant can not be initiated on a Mega Tenant for service AadGraphNotifications

So as far as I could understand, we cannot setup a webhook for a multi-tenant app.

So, I would like to know how I can achieve this functionality.

Thanks in advance.

Francisco Marrero 76 Reputation points

2025-02-19T13:43:09.1+00:00

It sounds like you're encountering a limitation with setting up webhooks for multi-tenant applications. However, there are ways to work around this issue. Here are some steps you can follow to achieve this functionality

Create a Multitenant Application: Register a multitenant application in your Microsoft Entra ID directory. This application will represent your workload's identity across different tenants.

Provision Service Principals: For each tenant, provision a service principal based on the multitenant application registration. This allows the application to authenticate services in the external directory.

Set Up Role-Based Access Control (RBAC): Assign appropriate RBAC roles to the service principals so they are authorized to access the necessary resources.

Use Azure Event Grid: Configure Azure Event Grid to deliver events to your webhook endpoint. Ensure that the event subscription writer is a Microsoft Entra application.

Secure Webhook Delivery: Use Microsoft Entra ID to secure the connection between your event subscription and webhook endpoint. This involves configuring the event subscription and ensuring the subscriber client's service principal has the necessary permissions.

Manage Cross-Tenant Communication: Use Azure Service Bus or another messaging service to facilitate communication between different tenants. This can help manage notifications and responses across tenants.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

How to setup webhook for user deactivation?

1 answer

Your answer