Azure App Service
Azure App Service is a service used to create and deploy scalable, mission-critical web apps.
8,934 questions
Issue Integrating Azure Easy Auth with 2-Tier App Service (React Frontend + FastAPI Backend)
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(41.6, 74%, 14%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ERP%3C/text%3E%3C/svg%3E)
Ravi Praneeth
50
Reputation points
We are trying to implement a 2-tier architecture using two Azure App Services:
- Frontend: React (with MSAL)
- Backend: FastAPI (using fastapi-azure-auth)
We’ve followed the official tutorial on Azure AD authentication for App Services: 🔗 https://learn.microsoft.com/en-us/azure/app-service/tutorial-auth-aad?pivots=platform-linux
We have completed the following steps:
- Enabled Azure AD-based authentication on both App Services.
- Assigned Managed Identities to both App Services.
- Registered two applications in Entra ID (one for frontend with SPA platform, and one for backend as Web API).
- Set the corresponding Client IDs and Redirect URIs in the App Service configurations.
- Used
MSALin React andfastapi-azure-authin FastAPI for auth token validation.
Problem:
When we enable Azure Easy Auth and attach the existing identities in App Services, the built-in Easy Auth flow interferes with our custom auth logic. The token validation breaks, and communication between the frontend and backend fails.
Questions:
- Is it possible to integrate Azure Easy Auth with this 2-tier (React + FastAPI) architecture?
- Are code modifications required when Easy Auth is enabled?
- Can you provide any sample projects or reference links that demonstrate this setup?
- How do we configure authentication so that App Services and Entra ID identities work together seamlessly?
Tested Approaches:
- Without Easy Auth: React (MSAL) + FastAPI (
fastapi-azure-auth) works fine using environment-based Entra App registrations. - With Easy Auth enabled: Breaks the flow even though identities are attached correctly. Any guidance or clarification from Microsoft on how to properly enable Easy Auth in this type of architecture would be appreciated. We are trying to implement a 2-tier architecture using two Azure App Services:
Azure App Service
{count} votes
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(112.00000000000001, 77%, 20%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ES%3C/text%3E%3C/svg%3E)
Sampath 3,750 Reputation points Microsoft External Staff Moderator2025-06-17T06:13:32.7733333+00:00 Hello @Ravi Praneeth ,
Can Easy Auth work with this architecture?
Yes, but not out-of-the-box. You’ll need to decide whether Easy Auth should handle all auth (and remove MSAL + FastAPI auth logic), or if you want to disable Easy Auth on the backend and let your custom logic handle token validation.
If you keep Easy Auth Your backend should trust the headers injected by Easy Auth instead of validating tokens itself.
- You’ll need to extract user info from
X-MS-CLIENT-PRINCIPALand map it to your app’s auth model.
If you disable Easy Auth on the backend:
- Keep using
fastapi-azure-authto validate tokens. - Ensure CORS and token scopes are correctly configured.
Below are Sample projects or references :
- fastapi-azure-auth GitHub repo has great examples for single- and multi-tenant setups.
Here are two viable patterns:
- Pattern A (Easy Auth handles everything):
- Enable Easy Auth on both frontend and backend.
- Remove MSAL and FastAPI token validation.
- Use headers like
X-MS-CLIENT-PRINCIPALto identify users.
Pattern B (Custom Auth):
- Disable Easy Auth on backend.
- Use MSAL in React to acquire tokens.
- Use
fastapi-azure-authto validate tokens in FastAPI. - Ensure frontend sends tokens in
Authorizationheader.
- You’ll need to extract user info from
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(192, 28.999999999999996%, 28%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EGK%3C/text%3E%3C/svg%3E)
Gaurav Kumar 780 Reputation points Microsoft External Staff Moderator2025-06-18T07:24:26.6833333+00:00 Hello @Ravi Praneeth ,
Just checking back if the above response was helpful, If you're still facing any issues, please click on Comment and let us know. Feel free to post back, we're happy to help! -
Gaurav Kumar 780 Reputation points Microsoft External Staff Moderator
2025-06-19T10:00:21.6233333+00:00 Hello @Ravi Praneeth ,
We haven’t heard back from you. If you're still facing any issues, please click on Comment and let us know. Feel free to post back, we're happy to help!
-
Gaurav Kumar 780 Reputation points Microsoft External Staff Moderator
2025-06-20T02:59:00.4133333+00:00 Hello @Ravi Praneeth ,
We haven’t heard back from you. Could you please check the private message I sent you?
-
Ravi Praneeth 50 Reputation points
2025-06-23T08:50:33.79+00:00 Hi Sankalp, Can you provide any documentation regarding this
Sign in to comment
Sign in to answer