Request OAuth2.0 token using azure app services managed identity

Question

Hi All,

I have a question on Azure App Service Managed Identity.

Currently we are working on an API project where it provide the function to interact with user in Azure Entra thru Microsoft Graph API calling. To protect the API function, we have a function for user to use ROPC flow authentication to request a token from https://login.microsoftonline.com/{tenant_id}/oauth2/v2.0/token. Currently we are providing the app registration's client ID and client secret in the request.

Our question is, can we exclude app registration, use only the app service managed identity in the process of requesting ouath2.0 token? If yes how do we do that? if no any document/article supported for it?

Answer 1

The user is not supposed to call the azure login endpoint. Your application is supposed to call the endpoint.

The user calls an application endpoint passing username and password and maybe scopes. The application calls the graph api and returns the token, which should be usable to call the api.

the password flow is used when the user can not use a browser to login, but wants to login to the app directly with their username password.

You should just expose the endpoint, not your clientid and secret.