Skip to main content

Access Azure Function App via OAuth 2.0 authentication

Access Azure Function App via OAuth 2.0 authentication

This guide explains how to protect an Azure Function App with Microsoft Entra ID and call it using a bearer token.

Goal

Protect HTTP-triggered Azure Functions so that only callers with a valid Microsoft Entra access token can execute them.

Use:

  • Authentication enabled on the Function App
  • Microsoft as identity provider
  • a dedicated app registration
  • Require authentication
  • a valid Application ID URI / audience
  • bearer token in the Authorization header

Avoid older patterns that rely on exchanging a token via /.auth/login/aad unless you have a specific legacy reason.

Configure authentication on the Function App

In Azure Portal:

  1. Open the Function App
  2. Go to Settings > Authentication
  3. Add identity provider: Microsoft
  4. Create or link an app registration
  5. Set unauthenticated requests to Require authentication

App registration considerations

For the protected API app registration:

  • set a proper Application ID URI
  • expose at least one API scope if user-delegated access is required
  • if daemon-to-function access is required, use application permissions / app roles as needed

Example audience:

api://<function-app-client-id>

Example: get bearer token with client credentials

$TenantId     = "<tenant-id>"
$ClientId     = "<caller-app-client-id>"
$ClientSecret = "<caller-app-client-secret>"
$Scope        = "api://<function-app-client-id>/.default"

$TokenBody = @{
    client_id     = $ClientId
    client_secret = $ClientSecret
    scope         = $Scope
    grant_type    = "client_credentials"
}

$Token = Invoke-RestMethod `
    -Method POST `
    -Uri "https://login.microsoftonline.com/$TenantId/oauth2/v2.0/token" `
    -Body $TokenBody `
    -ContentType "application/x-www-form-urlencoded"

Best practices

  • require authentication globally
  • use Entra ID instead of public function keys for privileged APIs
  • restrict accepted audiences
  • separate caller app registration from protected API app registration
  • prefer Managed Identity for Azure-to-Azure calling patterns

Summary

For secure Azure Function access in enterprise environments, protect the Function App with Microsoft Entra authentication and require valid bearer tokens.

Back to top