Authenticate to Graph API using APIM policy

Question

Hello,

I am trying to configure Azure APIM policy to authenticate to Graph API and get data from Intune.

I can get it easily from powershell using App registration (ID and secret) which has API permissions to read managed devices (screenshot attached).

However, configuring APIM policy is a bit different, tried same logic as powershell uses but can't retrieve access token.

Should I use something like managed identity for this purpose?
https://learn.microsoft.com/en-us/azure/api-management/api-management-authentication-policies#ManagedIdentity

Thanks

Answer 1

@Djordje Novakovic Thank you for reaching out to Microsoft Q&A. Yes, you are correct. authentication-managed-identity policy can be used to authenticate backend service (i.e., Graph API in your case) and refer docs for more details including examples. This way you don't need to manage client secret.

Also, found a similar example for key vault and thought it might be helpful with your question. This example has screenshot to enable managed-identity and assigning the access policy. Feel free to add a comment if you have any other questions. We would be happy to assist you. Please 'Accept as answer' and ‘Upvote’ if it helped so that it can help others in the community.

Answer 2

Thanks, I put ID of my application(which has permissions in Graph API) to this template:

and I see in APIM policy log it gets Bearer token from Azure AD:

I assume that now I can use that token and create new request to Graph API?