AUTHENTICATING TO AZURE AD PROTECTED APIS WITH MANAGED IDENTITY — NO KEY VAULT REQUIRED

 

Last Updated on October 18, 2021

A common way of authenticating to APIs, such as Microsoft Graph, has been that you set up an application registration in Azure AD, and create a client secret or a certificate. Then you store that sensitive information in an Azure Key Vault and have your application fetch it from there using its managed identity. After that, you’d use that fetched piece of information for authenticating to the API in your code. But did you know that there’s also an alternative way, which allows us to skip creating the application registration, client secret/certificate, and Azure Key Vault entirely?

We can allow our applications to authenticate to Azure AD protected APIs directly with the application managed identity. We don’t need to have a client secret or a certificate, and we can get rid of the risk of those pieces of sensitive information getting leaked. Otherwise, it works seemingly the same way by allowing us to use APIs with application permissions; it is just more secure.

Managed identity is not a new feature, and I know a few people have already blogged about this topic in the past. Still, I continue to run into developers who are not familiar with this approach. Based on my experience, it is clear that this method requires more exposure, which is why I am here writing about it for you. I hope you’ll find this article useful, and love using managed identity for authenticating to Azure AD protected APIs just as much as I do.

The Managed Service Identity (MSI) feature has been renamed to Managed identities for Azure resources. In this blog post, I’ll mostly be referring to this feature simply as managed identity.

WHAT ARE MANAGED IDENTITIES FOR AZURE RESOURCES?

A managed identity allows an Azure-hosted app to access other Azure AD protected services without having to specify explicit credentials for authentication. When you enable the managed identity for your app, a service principal gets created for your application in Azure AD. You can then grant that principal varying levels of permissions to the Azure resources and APIs used by your application. When we do not need to use and store separate credentials, it automatically improves the security of our application.

“When you enable managed identity on your web app, Azure activates a separate token-granting REST service specifically for use by your app. Your app will request tokens from this service instead of directly from Azure Active Directory. Your app needs to use a secret to access this service, but that secret is injected into your app’s environment variables by App Service when it starts up. You don’t need to manage or store this secret value anywhere, and nothing outside of your app can access this secret or the managed identity token service endpoint.” [source]

Managed identity is available for many Azure resources, such as Azure Functions, Web Apps and Logic Apps. You can check the Microsoft documentation for a full and up-to-date list of all the resource types that support managed identities.

SYSTEM ASSIGNED VS. USER ASSIGNED MANAGED IDENTITIES

We have two different types of managed identities: system assigned and user-assigned. Both of them work pretty much the same way from the authentication perspective, but they are administered quite differently. Being able to make the correct decision between them based on your scenario can help you reduce administrative overhead.

A system-assigned managed identity is always tied to just that one resource where it is enabled. You then control the permissions for that application individually. This is the preferred approach if your apps need different roles for different services.

A user assigned managed identity is created as a separate Azure resource. It can then be given permissions to services and added to multiple different Azure resources. This is the preferred approach if several apps need the same permissions to the same services.

Note that you don’t necessarily need to choose to use just either a system assigned or a user-assigned managed identity. Depending on the Azure resource, you can often combine both and use multiple user-assigned managed identities. You should always follow the principle of least privilege, and plan the permissions of the identities to be as fine-grained as possible.

ENABLING THE MANAGED IDENTITY FOR YOUR AZURE APPLICATION

You can enable the system managed service identity for an Azure resource by going to its Identity blade, changing the Status to On and then hitting Save. After saving, you’ll see a GUID in the Object ID field. This is the ID of the managed service identity. You’ll need the ID for managing your app’s permissions.

If you wish to use the user-assigned managed identities instead, you first need to create the User Assigned Managed Identity Azure resource, and then add it on the User assigned tab. You can see the object ID of the user assigned managed identity on its Overview blade.

MANAGING YOUR APP’S PERMISSIONS TO THE API

A widespread approach has been to enable the managed identity so that your app can securely access sensitive information stored in an Azure Key Vault. We’d do this for, e.g., getting a client secret from the key vault for authenticating to Microsoft Graph. However, it is also possible for us to grant our application permissions directly to Microsoft Graph (and other APIs) with PowerShell, which essentially allows us to skip the whole Azure Key Vault step entirely. At the time of this writing, PowerShell is our only option for performing this task; there is no way to do it in the Azure Portal.

For managing your application’s permissions using PowerShell, you first need to install the Azure AD PowerShell module, if you have not yet done so. You can install the module by running Windows PowerShell as an administrator, and then executing command Install-Module AzureAD.

Before you run the scripts, replace the miObjectId variable value with the ID of your application managed identity. You can see the ID in the view where you enabled the feature.

Also, if you want to manage your application’s permissions to some other API than Microsoft Graph, replace the appId variable value with the ID of the other API. You can find the ID of the API in the Enterprise applications view in Azure AD. There, select All Applications as the Application type, and search for your API. Then copy the GUID from the Application ID column.

ADDING PERMISSIONS

You can use the following script for granting permissions to an Azure AD protected API for your Azure-hosted app that has managed identity enabled. Replace the permissionsToAdd variable value with the API permissions/roles your application requires.

The user executing the script needs to have either Application administrator, Cloud application administrator or Global administrator role.

	# Replace with your managed identity object ID
	$miObjectID = "17707c90-dab4-483d-a57f-65e91ac3d94f"
	# The app ID of the API where you want to assign the permissions
	$appId = "00000003-0000-0000-c000-000000000000"
	# The app IDs of the Microsoft APIs are the same in all tenants:
	# Microsoft Graph: 00000003-0000-0000-c000-000000000000
	# SharePoint Online: 00000003-0000-0ff1-ce00-000000000000
	# Replace with the API permissions required by your app
	$permissionsToAdd = "User.Read.All", "User.Invite.All", "GroupMember.ReadWrite.All"
	Connect-AzureAD
	$app = Get-AzureADServicePrincipal -Filter "AppId eq '$appId'"
	foreach ($permission in $permissionsToAdd)
	{
	try {
	$role = $app.AppRoles | where Value -Like $permission | Select-Object -First 1
	New-AzureADServiceAppRoleAssignment -Id $role.Id -ObjectId $miObjectID -PrincipalId $miObjectID -ResourceId $app.ObjectId -ErrorAction Stop
	}
	catch {
	if ($_.Exception.ErrorContent.Message.Value -notcontains "Permission being assigned already exists on the object") {
	throw $_
	}
	}
	}

view rawadd-mi-permissions-to-graph.ps1 hosted with  by GitHub

CHECKING EXISTING PERMISSIONS

If you later need to check what permissions your app has to the API in question, you can do that with the following script. You can run this script without the administrator roles mentioned above.

	# Replace with your managed identity object ID
	$miObjectID = "17707c90-dab4-483d-a57f-65e91ac3d94f"
	# The app ID of the API where you want to assign the permissions
	$appId = "00000003-0000-0000-c000-000000000000"
	# The app IDs of the Microsoft APIs are the same in all tenants:
	# Microsoft Graph: 00000003-0000-0000-c000-000000000000
	# SharePoint Online: 00000003-0000-0ff1-ce00-000000000000
	Connect-AzureAD
	$app = Get-AzureADServicePrincipal -Filter "AppId eq '$appId'"
	$appRoles = Get-AzureADServiceAppRoleAssignment -ObjectId $app.ObjectId | where PrincipalId -eq $miObjectID
	foreach ($appRole in $appRoles) {
	$role = $app.AppRoles | where Id -eq $appRole.Id | Select-Object -First 1
	write-host $role.Value
	}

view rawget-mi-permissions-to-graph.ps1 hosted with  by GitHub

REMOVING PERMISSIONS

If your app no longer needs some of the permissions granted earlier, you can remove them individually with the following script.

	# Replace with your managed identity object ID
	$miObjectID = "17707c90-dab4-483d-a57f-65e91ac3d94f"
	# The app ID of the API where you want to assign the permissions
	$appId = "00000003-0000-0000-c000-000000000000"
	# The app IDs of the Microsoft APIs are the same in all tenants:
	# Microsoft Graph: 00000003-0000-0000-c000-000000000000
	# SharePoint Online: 00000003-0000-0ff1-ce00-000000000000
	# Replace with the permissions to remove
	$permissionsToRemove = "Group.ReadWrite.All", "Sites.ReadWrite.All"
	Connect-AzureAD
	$app = Get-AzureADServicePrincipal -Filter "AppId eq '$appId'"
	$appRoles = Get-AzureADServiceAppRoleAssignment -ObjectId $app.ObjectId | where PrincipalId -eq $miObjectID
	foreach ($appRole in $appRoles) {
	$role = $app.AppRoles | where Id -eq $appRole.Id | Select-Object -First 1
	if ($permissionsToRemove.Contains($role.Value)) {
	Remove-AzureADServiceAppRoleAssignment -ObjectId $app.ObjectId -AppRoleAssignmentId $appRole.ObjectId
	}
	}

view rawremove-mi-permissions-to-graph.ps1 hosted with  by GitHub

AUTHENTICATING USING THE MANAGED SERVICE IDENTITY

Here I have a couple of examples for you of how to use a managed identity for authentication in your solution. First, we have a .NET Core solution, and then I’ll show you how we can easily authenticate in an Azure Logic App using its managed identity. Again, I’m using Microsoft Graph as the API in both of these examples.

.NET CORE

As the first thing, install the Microsoft.Azure.Services.AppAuthentication NuGet package to your project, and specify a matching using statement for your namespace: using Microsoft.Azure.Services.AppAuthentication;

The method below will get an access token for the specified API using the managed identity of the Azure resource where your app is running. The resourceUrl (the URL address of the API) is the only mandatory parameter. The second parameter appId should only be specified when you are using the user-assigned managed identity. When the second parameter is not provided, system-assigned managed identity will be used by default.

	/// <summary>
	/// Gets an access token using the managed identity of the Azure resource.
	/// </summary>
	/// <param name="resourceUrl">The URL of the API, e.g., https://graph.microsoft.com</param>
	/// <param name="appId">Optional user assigned managed identity client ID. Defaults to system assigned identity.</param>
	/// <returns>Returns the Bearer access token value</returns>
	public async Task<string> GetAccessTokenAsync(string resourceUrl, string appId = null)
	{
	string connectionString = appId != null ? $"RunAs=App;AppId={appId}" : null;
	var tokenProvider = new AzureServiceTokenProvider(connectionString);
	return await tokenProvider.GetAccessTokenAsync(resourceUrl);
	}

view rawGetAccessTokenAsync.cs hosted with  by GitHub

Note that the code snippet above does not work while you are debugging your code locally. After all, your app needs to have an Azure managed identity for authentication, which your app will only have when it is hosted in Azure. It is up to you to decide how you wish to implement authentication for local debugging. Alternatively, you can deploy your app to Azure and debug it remotely.

AZURE LOGIC APPS

Calling an API in Azure Logic Apps with the HTTP action by using a managed identity is super easy. You first add either a system-assigned or a user-assigned managed identity for your app — just like you would for any other Azure resource. Then, while configuring the HTTP action, you select Managed Identity as the authentication type and select the identity from the dropdown. The only thing that requires a bit of typing regarding authentication is the Audience which is the URL of the API you want to call.

Note that Azure Logic Apps can only have either a system-assigned or user-assigned managed identity; it can’t have both. Moreover, when using user-assigned managed identities, you can only add one identity to your app.

AFTERWORD

So, what do you think of using managed identities for authentication? They are pretty awesome, eh? If you have any thoughts, comments or questions about the topic, feel free to write about them to me using the comments section below. I genuinely hope you enjoyed reading this article and found it useful.

Also, if you’d like to consume more content from me, feel free to subscribe to my Insider (news)letter and follow me on your favourite social media platforms (Twitter, YouTube, LinkedIn, Github). I share different types of content on each one of them.

Thank you for reading, it is always appreciated, and until next time!