Configuring App Registration/Angular MSAL for API access with downstream Key Vault OBO flow

Question

Configuring App Registration/Angular MSAL for API access with downstream Key Vault OBO flow

Douglas Crawford 0

Hello,

Wasn't sure which child tag to use -- this question falls under Entra ID (possibly Angular MSAL).

I'm having trouble with an authenticated user's MSAL access token scopes.

I have the following MSALInterceptorConfigFactory in my Angular 20 MSAL config:

// msal.config.ts
export function MSALInterceptorConfigFactory(): MsalInterceptorConfiguration {
  const protectedResourceMap = new Map

Rukmini 42,675 Reputation points Microsoft External Staff Moderator

2025-11-04T13:26:52.4966667+00:00
Hello Douglas Crawford,

To achieve your scenario, you need to create two Microsoft Entra ID applications.

Create Backend API app, choose Web and expose an API with scope user_impersonation and add delegated permission for Azure Key Vault.

Create Angular app, choose Single-page application (SPA) and add Redirect URI as http://localhost:4200

Grant admin consent to API permission (Add a permission -> APIs my organization uses -> Search Backend API and select user_impersonation)

In Angular (msal.config.ts) use the below:

protectedResourceMap.set('https://localhost:5001/api/', [ 'api://<API_APP_ID>/user_impersonation', ]);

As per your requirement to use OBO flow to get a Key Vault token, use the below in your API code for example c#

var result = await cca.AcquireTokenOnBehalfOf( new[] { "https://vault.azure.net/.default" }, new UserAssertion(incomingAccessToken) ).ExecuteAsync();

By doing this the user will sign in to the Angular app and token for the API app will be generated.

API swaps that token for a Key Vault token and it calls Key Vault by using OBO flow.

Hope this helps!

Let me know if any further queries - feel free to reach out!
Rukmini 42,675 Reputation points Microsoft External Staff Moderator

2025-11-05T09:11:54.0666667+00:00

Hello Douglas Crawford, Following up to see if the above provided information was helpful. If you have any further queries do let us know.