Entra ID Web API Authorization Model

Question

Entra ID Web API Authorization Model

ritmo2k 931

I have an ASP.NET Core Web API that we host for use by other teams and services. I would appreciate guidance on how to design the permission model.

The long-term goal is to set up a public client and build tooling for users. We also plan to provision app registrations for automation that requires API access. The short-term focus is limited to app registrations.

We want to use security groups for fine-grained authorization because the API has too many permissions, and those permissions change too frequently, to manage effectively with scopes or app roles. Security groups also align well with the existing processes used to manage the data behind the API.

Given the pending interactive delegated permission model for the public client, and the non-interactive application permission model for service principals, am I missing anything by avoiding scopes and app roles entirely and relying only on a custom authorization policy handler in the Web API?

0 comments

Answer accepted by question author

0 additional answers

Your answer

Answer 1

Rukmini 43,260 Microsoft External Staff Moderator

Hello @ritmo2k

It is possible to fully implement authorization using security groups and a custom policy handler, but there are certain trade-offs to take into account. * Security groups are ideal for fine-grained permissions that are in line with current access-management procedures and are subject to frequent changes.

Nevertheless, a common mechanism to regulate which clients or service principals are initially permitted access to the API is provided via scopes (delegated) and app roles (application permissions).
Scopes also facilitate consent and offer a more explicit authorization contract between the client and the API for future delegated user scenarios.
Furthermore, your API may need to access Microsoft Graph to assess group membership for application identities because service principals do not consistently get group claims in tokens.

Hence, Use a hybrid approach

To manage API access, define a few coarse-grained scopes/app roles (like Api.Access). For fine-grained authorization within the API, keep use security groups and custom authorization policies.
This maintains future flexibility and standard Entra ID access controls while offering a scalable authorization solution.

Let me know if any further queries - feel free to reach out!

Hello @ritmo2k

If the resolution was helpful, kindly take a moment to click on and click on Yes for was this answer helpful. And, if you have any further query do let us know.

ritmo2k 931 Reputation points

2026-06-19T01:31:59.6933333+00:00

HI @Rukmini

Thank you for the feedback. One of the motivations was to avoid requiring admin consent, as it doesn't semantically make much sense or add anything. Scopes can at least be created so the user can consent themselves, but app I don't think that is the case for app roles. That means every automation use case that requires a service principal also needs an admin to consent on their behalf. Is that understanding accurate?

However, your suggestion does have an intuitive approach that I can utilize, so I will proceed with it.

Thanks again!
Rukmini 43,260 Reputation points Microsoft External Staff Moderator

2026-06-19T17:32:59.6333333+00:00

Hello @ritmo2k

Yes, your understanding is correct. For application permissions (app roles), admin consent is required because service principals operate without a signed-in user and cannot provide consent themselves.

This is one of the trade-offs of using app roles as a coarse-grained access gate. If minimizing admin involvement is a priority, relying primarily on security groups and custom authorization logic can simplify permission management, while a minimal app role (for example, Api.Access) can still provide a standard Entra ID access boundary for service principals.

Glad the hybrid approach is useful for your scenario.
Rukmini 43,260 Reputation points Microsoft External Staff Moderator

2026-06-19T17:41:02.2366667+00:00

Hello @ritmo2k

If the resolution was helpful, kindly take a moment to click on and click on Yes for was this answer helpful. And, if you have any further query do let us know.