I am in the process of converting multiple traditional webparts to provider hosted apps to make them compatible for sharepoint online. Can I create client id and client secret only once for production SP online environment and reuse them across all apps or do I need to create a separate for each?
2 Answers
You need create client id and client secret for each add-in(app) as it's add-in identity just like user account, can't be reuse.
When you generate a client id/secret, you must specify the domain that the app will be on, and you can only specify a single domain. When you generate the id/secret, Service Principal gets created on the azure tenant, with the client id and the client id/domain as service principal names.
For example, with an id of 123e4567-e89b-12d3-a456-426655440000, and a domain of contoso.com, the following would be the service principal names:
123e4567-e89b-12d3-a456-426655440000
123e4567-e89b-12d3-a456-426655440000/contoso.com
These must be unique across all service principal, which means you cannot have two apps with the same client id.
You can, however, have an app use any id/secret. But, if the domain does not match the one the id is registered to, users will receive a warning when they navigate to the app (though they can proceed through it).
I wrote an answer here on generating ids/secrets through PowerShell, if you're interested, and I have a few scripts for retrieving/updating secrets as well.
