azureazure-entra-id

Generate a Token for Testing FunctionApp Protected by Entra

This question got me most of the way there. I successfully generate a token, but get a 403.

Function app (FA) serves an API that is consumed by 1 WebApps ApplicationId. All identites are authorized. Portal Screenshot for auth
I would like to test without the webapp, preferrably with postman.

My guess is I am not generating the client credential correctly: ClientId: Is this the FA that is serving? Client Secret: Has to be the FA that is serving the API, Object Id: Which Object FA or WA (although I got a token without including) Scope: {FA clientid}/.default Auth endpoint, Token endpoint.

Is ClientCredentials the correct GrantType. I cannot use Password because tenant requires 2-Factor Open to Implicit or AuthCode, but I could not figure out the right parameters for them.

Solution

  • Created an Azure Function app and added identity provider as Microsoft:

    enter image description here

    Now I edited the Identity provider and allowed requests from specific client application:

    enter image description here

    In the application and API will be exposed:

    enter image description here

    In the Microsoft Entra ID application, I granted API permissions like below:

    enter image description here

    And generated access token for client application:

    scope : ClientID/.default

    enter image description here

    I got the same error:

    enter image description here

    The 403 error usually occurs if the access token does not have required permissions to perform the action.

    To resolve the error, make sure to pass scope as api://ClientAppID/.default not ClientAppID/.default

    enter image description here

    Now regenerate the access token by passing scope as api://ClientAppID/.default:

    GET https://login.microsoftonline.com/TenantID/oauth2/v2.0/token

client_id : ClientID
client_secret : Secret
scope : api://xxx/.default
grant_type : client_credentials

    enter image description here

    I am able to successfully access the function API:

    GET https://rukfapp.azurewebsites.net/api/HttpTrigger2

    enter image description here

    If you are making use of two different applications, one for identity provider and one more as client application then make sure to either grant API permissions to client application from the identity provider app OR configure client app as allowed audience in identity provider.