How to authenticate to Azure App Service using DefaultAzureCredential

Question

How to authenticate to Azure App Service using DefaultAzureCredential

Matthew Jensen 55

I've created an application in Azure App Service, currently it's accessible via the browser using Entra ID Easy Authentication.

I'd like to access the application via my Default Azure Credential in Python but I run into the error: DefaultAzureCredential failed to retrieve a token. I have no issue getting a management.azure.com token.

I don't want to be create more app registrations I just want to use my own Entra ID account to access the web app, how is this possible?

Locked Question. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

Christos Panagiotidis 3,546 Reputation points

2026-07-29T14:47:25.6366667+00:00

You have App Service Microsoft Entra authentication working in a browser, but a Python client using DefaultAzureCredential obtains a management token rather than one accepted by the app. The access token must target the App Service application’s audience, not Azure Resource Manager. Reuse the app registration already associated with Easy Auth: expose or confirm its delegated scope, the application’s Application ID URI plus user_impersonation, and configure that client ID or URI in Allowed token audiences. Locally, sign in to the tenant with Azure CLI or another credential supported by DefaultAzureCredential, request a token for the API scope, and send it as a Bearer token. Verify the token’s aud, tenant, and delegated scopes before calling the site. User or administrator consent may be required. You cannot secure a custom API and issue correctly targeted tokens without a resource app registration, but reuse the existing Easy Auth registration rather than create one.

Christos Panagiotidis 3,546 Reputation points

2026-07-29T14:47:25.6366667+00:00

You have App Service Microsoft Entra authentication working in a browser, but a Python client using DefaultAzureCredential obtains a management token rather than one accepted by the app. The access token must target the App Service application’s audience, not Azure Resource Manager. Reuse the app registration already associated with Easy Auth: expose or confirm its delegated scope, the application’s Application ID URI plus user_impersonation, and configure that client ID or URI in Allowed token audiences. Locally, sign in to the tenant with Azure CLI or another credential supported by DefaultAzureCredential, request a token for the API scope, and send it as a Bearer token. Verify the token’s aud, tenant, and delegated scopes before calling the site. User or administrator consent may be required. You cannot secure a custom API and issue correctly targeted tokens without a resource app registration, but reuse the existing Easy Auth registration rather than create one.