1

We have a need to connect to some external APIs from SharePoint. I've seen some online articles about calling APIs that are secured with Azure AD, however, in my case I have no control or influence over the APIs, how they are set up, or how they are secured.

Is there a known, secure solution for calling external APIs that you have no control over, from SharePoint, without exposing credentials (by calling on the front end)?

I was speculating whether we could in Azure set up a function that calls the API so that SharePoint only ever has to call that function. The API credentials could be kept securely in Azure in that case?

Any thoughts, ideas, or previous experiences would be massively appreciated.

Improve this question
5
  • Hi Steven, are you going to use modern pages? What would need to trigger this API? a button in the SPFx webpart? Or Power automate Flow? Or Script webpart?
    – Denis Molodtsov
    Apr 14, 2020 at 13:56
  • 1
    At the moment we're using custom Angular pages on top of Classic but we'd like to move to both Modern & SPFx in the future (but still have a bit more research to do before we're ready for the leap). We'd like to take an input from a user, ideally from our Angular page and somehow use that to safely query the API.
    – Steven Walker
    Apr 15, 2020 at 14:06
  • I know how you would do it using SPFx and Azure Apps. But calling a custom API securely from a classic page is something that will be very tricky to do. I would love to know myself the best way to do it.
    – Denis Molodtsov
    Apr 15, 2020 at 14:51
  • What would be the best way assuming we are using SPFx (as this is something we'll very likely be doing in the near future)? Does the Azure instance have to be on the same tenant as the SP?
    – Steven Walker
    Apr 15, 2020 at 15:12
  • It helps a little if you host your Azure Function in the same Azure tenant used by Office 365, but it's not required. This is an article that I have followed and it worked perfectly. This way you can call an API from an SFPx webpart and on the Azure side know who the user was who called this API. There are 1-2 other similar high quality articles I've seen too.
    – Denis Molodtsov
    Apr 15, 2020 at 16:08

1 Answer 1

Reset to default
1

I would develop an provider hosted add-in and call the external API from the server-side code. Credentials to the external API could be stored in a KeyVault which the app service (hosting the server-side code) is entrusted to access.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.