Configure authentication for Edge RAG Preview enabled by Azure Arc

For your Edge RAG deployment, register an application, create app roles, and assign users or groups in Microsoft Entra ID. This article is part of the deployment prerequisites checklist and also a prerequisite of Quickstart: Install Edge RAG.

You might need to work with your Microsoft Entra or cloud administrator to configure authentication.

Prerequisites

Before you begin, make sure you have:

• An active Azure subscription. If you don't have a service subscription, create a free account before you begin.
• Microsoft Entra ID permissions:
  • Permissions to create a Microsoft Enterprise Entra application.
  • Ability to add new or existing Microsoft Entra users and groups to the application.

Register an application in Entra ID

Create and configure an application registration for Edge RAG in your Microsoft Entra ID tenant.

1. In the Azure portal, go to Microsoft Entra ID.

2. Go to the appropriate tenant and select Manage > App registrations.

3. Select New registration to create an application registration.

   

4. Enter EdgeRAG for Name.

5. Select Accounts in any organizational directory (Any Microsoft Entra ID tenant - Multitenant).

6. Select Register.

   

7. After the application is registered, go to the registration and select Manage > Authentication.

8. Select Add a platform > Single-page application.

9. Specify your domain name appended with /authorizing (for example, https://arcrag.contoso.com/authorizing) as the Redirect URIs.

   

10. Select Configure.

11. For Supported account types, select Accounts in any organizational directory (Any Microsoft Entra ID tenant - Multitenant).

    

12. Select + Add a platform > Mobile and desktop applications.

13. For Redirect URIs, select https://login.microsoftonline.com/common/oauth2/nativeclient.

14. Select Configure.

Create app roles for Edge RAG

Within the Edge RAG app registration, create app roles for AI application developers and end users of the chat endpoint.

1. In the app registration, on the left-hand side menu, under Manage, select App roles.

2. Create two app roles. One for EdgeRAGDeveloper and another for EdgeRAGEndUser. Use the appropriate values listed in the table that follows the image.

   

   Field	Value
   Display name	EdgeRAGDeveloper or EdgeRAGEndUser
   Allowed member types	User/Groups
   Value	EdgeRAGDeveloper or EdgeRAGEndUser
   Description	EdgeRAGDeveloper or EdgeRAGEndUser
   Do you want to enable this app role?	Checked

3. When complete, close the App roles page.

Assign users or groups to roles

Next, in the Microsoft Entra ID tenant, assign users or groups to the roles you created for Edge RAG.

1. In the Microsoft Entra ID tenant, on the left-hand side menu under Manage, select Enterprise applications.
2. Search for and select the EdgeRag application you created.
3. Go to Manage > Properties.
4. Disable Assignment Required.
5. On the left-hand side menu, select Users and groups > Add user/group.
6. Select users and/or groups and assign EdgeRAGDeveloper or EdgeRAGEndUser role as appropriate.
7. When complete, close the Users and groups page.

(Optional) Get app and tenant IDs

If you plan to use the quickstart or want to deploy Edge RAG by using the command line, get the application ID for the registration you created and the tenant ID.

1. In the Azure portal, search for app registration.
2. Select the Edge RAG registration you created.
3. Copy the Application (client) ID and Directory (tenant) ID.
4. Paste the values to an app like Windows Notepad to use later.

Next step