acquire a token of app registration with MI , via powershell Rest in an azure function app

Hello,

I am trying to acquire a token from an app registration. Since this app registration has API permissions I want to use, I need to do it with managed identity.

To achieve this, I created a function app where I published the following code.
the client is the App registration client id ( should it be something else ?)

Also not sure if the scope is the correct way to write it .

param($Request, $TriggerMetadata)

# Set the client ID of the App Registration that the managed identity is federated to
$clientId = "3f13273c-3fab-4887-94ec-e9c29b543dc1"

# Set the scope for the token (usually the App ID URI of the target API)
$scope = "api://AzureADTokenExchange/.default"

# Request the token from Azure Instance Metadata Service (IMDS)
try {
    $response = Invoke-RestMethod -Method GET -Headers @{Metadata="true"} -Uri "http://169.254.169.254/metadata/identity/oauth2/token?client_id=$clientId&resource=$scope&api-version=2018-02-01"
    
    # Extract the token
    $accessToken = $response

    # Return the token in the HTTP response
    Push-OutputBinding -Name Response -Value ([HttpResponseContext]@{
        StatusCode = 200
        Body = @{
            access_token = $accessToken
        } | ConvertTo-Json -Depth 3
    })
} catch {
    # Handle error and return the error response
    Push-OutputBinding -Name Response -Value ([HttpResponseContext]@{
        StatusCode = 500
        Body = @("Error retrieving token: $($_.Exception.Message)")
    })
}

As you can see in the attached screen shot it is being published properly.

I also have a federated identity based on the managed identity I created on the app registration, and that same identity is in the Azure function.

However, when I try to get the response to see if it has the token, the response is constantly empty. I believe there is an issue with how I am trying to acquire the token with the invoke request , in the code.

# Define the function URL

az account set --subscription "51828c2e-c358-414d-9739-e799a65b0fdf"


$functionKey = az functionapp function keys list --name R2D-Kusto-AzureFunctionPs --resource-group kusto-r2d-resources --function-name gettokenfunction --query "default" --output tsv | Out-String


$functionKey = $functionKey.Trim()

$functionUrl = "https://r2d-kusto-azurefunctionps.azurewebsites.net/api/gettokenfunction?code=$functionKey"

# Call the function
$response = Invoke-RestMethod -Uri $functionUrl -Method GET

# Extract and display the token
$token = $response
Write-Output "Access Token: $token"

Write-Output "Access Token: $token"

Invoke-RestMethod : The remote server returned an error: (500) Internal Server Error.

At line:14 char:13

• $response = Invoke-RestMethod -Uri $functionUrl -Method GET

•         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  

  • CategoryInfo : InvalidOperation: (System.Net.HttpWebRequest:HttpWebRequest) [Invoke-RestMethod], WebException
  • FullyQualifiedErrorId : WebCmdletWebResponseException,Microsoft.PowerShell.Commands.InvokeRestMethodCommand

Access Token: @{access_token=}

Could someone please help me understand what might be wrong and how to get the token from the app registration?