Securing azure functions with MSAL

Title
Securing azure functions with MSAL
URL Name
Securing-azure-functions-with-MSAL

Question
Answer

This guide explains how to protect your azure functions instance with MSAL authentication, either require or optionally offering your users to use SSO (Single sign on) to authenticate before they can use services from this service.

Function/App Service Step 1

  • Visit the Azure Function/App Service dashboard on your Azure portal
  • Go to Authentication blade
  • Add identity provider
  • Select Microsoft
  • Choose existing app registration or create a new
  • Under restrict access select one of the options:
    • Require authentication, choose to redirect users (302)
    • Allow unauthenticated access - this will allow users to access the site without logging in. You will have to check the user name in your application if you would like to limit/block access.
  • Leave the default permissions for now. We will update this later.

App registration - authentication

  • Go to the app registration -> Authentication
  • Add a platform Single-page application if not already there
  • Add a redirect URI for your function under Single-page application, point to your SharePoint root site: https://[company].sharepoint.com
  • Optional: Add a redirect URI under Web platform to: https://[your_function_name]. azurewebsites.net/.auth/login/aad/callback
only needed if you plan to visit the page directly in browser.
  • Check both Access tokens and ID tokens
  • save your changes

App registration - API

  • Visit the Expose an API blade
  • Make sure application ID URI is set to api://[your app ID]
  • add a scope named access_as_user
  • copy the Application ID URI

Function/App Service Step 2

  • go back to your azure function/app service dashboard
  • go to the authentication blade
  • Click edit on the Microsoft identity provider
  • Paste the Application ID URI into Allowed token audiences
  • save changes

More info:

You can now access this endpoint as an external data source with MSAL authentication! Read more in the Creating External Data Sources guide.

To publish an Azure Function that can access your SQL server securely, read Using SQL server as an external data source

Security, Compliance & Governance