Configure React/Node app using Bearer token to the same Azure AD App

Question

Hello! I'm building an app that will authenticate users using Azure AD. The app consists of a frontend React application and a backend NestJS application (Library built on Node and Express). I am using this Azure-Samples github repo as a guide,
https://github.com/Azure-Samples/ms-identity-javascript-react-tutorial/tree/main/3-Authorization-II/1-call-api

In essence the repo guides you through authenticating a user on the frontend using SSO, then passing a Bearer token to the backend. Eventually I would like to get to the point where users are persisted and can have information stored in a database on the backend, but for now just authentication.

In the README the guide instructs me to make two separate Azure AD applications. I am wondering, for the sake of maintainability and dealing with the IT team I'm working with is it possible to have both the frontend and backend share a same Azure AD Application. It seems weird to have to create two applications for what is essentially just one application. If it is possible, how can I achieve it

Answer 1

Hi @Ben Munro · Thank you for reaching out.

You can certainly register one application and use that as Service App as well as Client App. The only problem I see in that case is, if you don't provide Admin Consent for access_as_user scope/permission, users will still be able to acquire token with this scope as the Client and Service (API) app are same.

If you register these applications separately, no one can acquire a token with access_as_user scope if Admin Consent is not granted.

If you use single app, and want to restrict issuance of token to a specific set of users (as anyone can get token with defined scopes) for this app, you can navigate to:

Azure AD > Enterprise Applications > Open the app > Properties > set User assignment required to YES and then assign users by using the Users and groups blade. That way, only the assigned users can acquire token for this app.

-----------------------------------------------------------------------------------------------------------

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.