Authenticate Azure Function with Azure Web App Using Managed Service Identity

Azure Functions are getting popular, and I start seeing them more at clients. One typical scenario I come across is to authenticate an Azure Function with an Azure Web API. Every time something like this comes up, it means more Azure AD applications, which in turn means more secrets/certificates that need to be managed. But with Managed Service Identity (MSI) feature on Azure, a lot of these secrets and authentication bits can be taken off from our shoulders and left to the platform to manage for us.

[alitswq]

Rahul, The way you show the differences is fantastic. Good job!

[ChandanKumar-esbz]

Thanks man after a long wait i get this video

[soucianceeqdamrashti]

Very well explained and good code demo! Keep it up!

[AgeOfFails]

Seems that I've found a hidden gem! Thanks for the explenation, was very clear and to the point!

[adamtibi]

This is a well prepared short video. Thank you.

[gayanrathnayaka]

I get the following Error any Idea? Parameters: Connection String: [No connection string specified], Resource: 0a200f72-48d3-4a8d-b7ec-b43b6b879984, Authority: . Exception Message: Tried the following 3 methods to get an access token, but none of them worked. This is only a part of the exception

[bencarp]

Regarding the auth level settings for the function. I notice you have it set to function. When using managed identity, does it matter which level is used? Also, do we need to utilize the authentication blade, or does the Azure infra take care of that for us?

[vinothrajendran]

Thanks for this video Rahul. Do you have video for that web api? I want to know how it is validating this token and how it was registered in AAD?

[piyalibasak]

I have some confusion on it.Please cleare it.Generally I know herein this case case i need two app registration.one for web api another for azure function.bt here we have used one app registration, the one we have configured in web api..same one we have used in function app to call the web api..can you please explain why?.If I create another app registration for function app.and that function app client id if I use to call the web api is that correct?

[Wanted_VXRAIL]

Im having big troubles trying to get a valid accesstoken using a user assigned identity in azure functions to call my api which is an appservice. I get a token out of it but I cant access the api, it says neither scope or claim was found in token. Any idea?

[IndrajithReddyMandapati]

Azure Service Token Provider is working only after deploying into Azure. Getting error while running in local machine. Can you please tell how to get token in local development and in postman?

[TheShrutika]

Hi Rahul, I am facing a prb in azure functions .. i have installed vs 2019 selecting the azure tools from the installer . I have dot net framework sdk from4.6.1 till 4.8 installed as well. I am able to successfully create, run and debug locally azure functions created using dot net core . I’m the solution explorer I can see the azure function icon and it runs perfectly fine . But with dot net framework it doesn’t. It creates some sort of class project which I can’t run locally .. any idea what I am missing here ?? Please lemme know it will be great help

[vivekamity]

Nice demo. You have done changes in Functionapp by enabling System assigned identity and Getting the token for a client id. How is the api's secured? Anybody can enable identity and generate token using client id and he/she can invoke api?

[sawarkarashish]

Explained very well and I followed all steps for MSI but getting the error of unauthorized. Can you plz guide me where can be issue?

[Rajeshsingh-wsth]

when it being hard coded it defeated the purpose of security.