Azure Functions

The Microsoft Identity Web library enables Azure Functions to work with the Microsoft identity platform, enabling them to process access tokens for both work and school and Microsoft personal accounts, as well as Azure AD B2C.

From the point of view of Microsoft.Identity.Web, Azure Functions with HTTP trigger are very similar to web APIs.

This library adds ServiceCollection and AuthenticationBuilder extension methods for use in the ASP.NET Core web app Startup.cs file. These extension methods enable the web app to sign in users with the Microsoft identity platform and, optionally, enable the web app to call APIs on behalf of the signed-in user.

It also adds a project template to create an Azure Functions application:

• dotnet new func2 --auth SingleOrg for AAD protected services
• dotnet new func2 --auth IndividualB2C for Azure AD B2C protected services

If you use these project templates, you'll get a fully functional application once you have filled in the configuration.

In the case of AAD protected services, you can also create an Azure Function that calls Microsoft Graph or a downstream API.

• dotnet new func2 --auth SingleOrg --calls-graph
• dotnet new func2 --auth SingleOrg --called-api-url URL --called-api-scopes SCOPES

While the generated code demonstrates the usage of Microsoft.Identity.Web to get a token on the user's behalf using the on-behalf of flow, the code can be easily customized to support other scenarios Azure Functions and Microsoft.Identity.Web support. For instance, asking for an application permission token in a timer triggered Azure function. Additionally, getting a token on user's behalf is not possible with Azure AD B2C, as the service does not allow the on-behalf of flow (web APIs calling downstream APIs).

If you want to add authentication to an existing Azure Functions app, the following paragraph explain how to modify the code for your application.

The appsettings.json needs to have a section describing the Microsoft.Identity.Platform application

{
  "AzureAd": {
    "Instance": "https://login.microsoftonline.com/",
    "Domain": "msidentitysamplestesting.onmicrosoft.com",
    "TenantId": "7f58f645-c190-4ce5-9de4-e2b7acd2a6ab",
    "ClientId": "a4c2469b-cf84-4145-8f5f-cb7bacf814bc"
  },
...
}

To enable the Azure Function to be protected with the Microsoft identity platform:

1. Add the Microsoft.Identity.Web and Microsoft.Identity.Web.UI NuGet packages

2. Edit the Startup.cs file to add the authentication code. Add a constructor to get access to the IConfiguration object.

   public Startup(IConfiguration configuration)
   {
       Configuration = configuration;
   }
   
   public IConfiguration Configuration { get; }

   The authentication middleware goes into the ConfigureServices() method. Update it with the following code:

   services.AddAuthentication(sharedOptions =>