Azure

Azure AD authentication in Azure Functions

Ever had the need to enable Azure Active Directory authentication in Azure Functions? In a recent project, I wanted to use Azure Functions, and I wanted both system-to-system authentication, as well as user-based. As Azure Functions is a part of the app services in Azure. It shares many of the same features. Authentication is one of them.

Enable authentication

The scope for this blog post is not to show you how to build an Azure function, but to enable Azure AD authentication on it. You can add auth to your existing function or create a new one using your method of choice. For simplicity, I will show the process of using the Azure portal.

To enable authentication in Azure Function. Navigate to “Authentication/authorization”. This will open a series of blades which guides you through the process.

If you’re not familiar with Azure AD and custom application registrations, I recommend that you use the Express option. This will create the needed application in AAD for you.

Enable azure ad authentication in azure function

Enable azure ad authentication in azure function

Enable azure ad authentication in azure function

Change to anonymous authentication

By default Azure Function uses something called “Function authentication” This is where all your requests have a code parameter at the end of the URL.

https://my-function-app.azurewebsites.net/api/function-name?code=xyzx-zyxx...

We want to have Azure AD perform authentication and authorization, and not the function itself.

Within the GUI, it’s just a flick of a switch. If you are developing locally, using C# you typically do this:

public static HttpResponseMessage (run [HttpTrigger( AuthorizationLevel.Anonymous)] HttpRequestmessage request) { logic }

Enable user assignment

After changing the authorization level and enable AAD authentication,
all users in your organization will automatically have access. If you want more granular control over who has access to your application, you should enable user assignment.

To enable user assignment. Navigate to enterprise application under AAD, and look up the app created by the wizard. The enterprise app is the service principal representing the application you created. Your Azure Function.

Under properties, find the swith for user assignment and turn it on. Navigate to your function URL and see if it works, meaning access denied.

Later add your own user and verify authentication works through Azure AD.

If you want other applications (clients) to call your function, you will have to assign them API access. The same way you give access to for example Microsoft Graph API, you will find your custom application as well.

This will not work right away – By default, there are no application roles assigned. Only delegated permissions. For client authentication to work, you will need to add custom roles to the app representing your Azure Function. It is not difficult, but I used too much time finding it out. Microsoft has it documented here

Authenticate with code

Chances are that your azure function is not a graphical website. Therefore I assume you want to authenticate using code. Either with your own user, or with a separate application/secret combination (app credentials).

The great thing about this is that it works just as any other Microsoft/Azure APIs. If you know how to get a token from Microsoft, you can use the same techniques against your function. My example below show how to retrieve a token for our azure function, and use that bearer token against the function. I use a client application in this scenario.

Summary

This feature is great. I consider my self as a modern IT operations guy. And operations role these days requires more coding and scripting. It is super easy to expose things on the internet. But remember, it might also be just as easy to secure.
I have no idea on how to implement a authentication layer. And if i can use one of the best, i’m all aboard.

24 COMMENTS
  • sex

    Thank you very much for sharing, I learned a lot from your article. Very cool. Thanks.

  • rrinimabi

    Thank you very much for sharing, I learned a lot from your article. Very cool. Thanks.

  • Azure token from a customized app registration - Firnco

    […] to authenticate a customized API the usage of shopper credentials. In truth, I’ve written about how you can do that in the past the place we accessed a customized API constructed on Azure Purposes. Authentication-wise, I […]

  • Azure token from a custom app registration - adatum

    […] straightforward to authenticate a custom API using client credentials. In fact, I have written about how to do that previously where we accessed a custom API built on Azure Functions. Authentication-wise, I also wrote a post […]

  • Azure Ad Api Login - Login Database

    […] Azure AD authentication in Azure Functions adatum […]

  • Azure Ad Login Api - Login Database

    […] Azure AD authentication in Azure Functions adatum […]

  • Azure Application registrations, Enterprise Apps, and managed identities | adatum

    […] are a lot more to go through when talking about authentication. How to obtain Azure access tokens or how you add Azure login to your website is not covered here. However, I hope this post made the […]

  • Homepage

    … [Trackback]

    […] There you will find 16841 more Infos: adatum.no/azure/azure-ad-authentication-in-azure-functions […]

  • Secured Blazor WebAssembly app hosted as static website – A developer's blog

    […] https://adatum.no/azure/azure-ad-authentication-in-azure-functions […]

  • O hai let me wanna-be! pe Trilema - Un blog de Mircea Popescu.

    […] are seeing this because your blog was recently used as part of a DDOS attack against […]

  • Abby

    And btw any idea why my exisiting app is not listed on the drop down when I select existing app option

  • Abby

    Hi i dont know how to get the scopes any idea?

  • Kiran Pradeep

    Thanks. This post was helpful.

  • Ankit

    Followed all steps and found that applications which arent given permissions to the custom role can still call the API

    1. Martin Ehrnst

      Hi Ankit. You’re saying that all app registration in your directory can get an access token and access your function?

  • Gary Howlett

    Great easy to read post – Thanks! For getting the calling user there is a ClaimsPrinciple binding available https://azure.microsoft.com/en-gb/blog/simplifying-security-for-serverless-and-web-apps-with-azure-functions-and-app-service/

    1. Martin Ehrnst

      Thanks Gary. I don’t think that was available when I posted this? Do you happen to know if it is available for PowerShell?

  • Ankit Vijay

    Great post, perhaps it is good to mention that “Authentication / Authorization” feature is not available for Linux Consumption Plan. I stumble upon this issue while following steps from this post.

    1. Martin Ehrnst

      Thank you Ankit. I did not know that! Is it a documented limitation?

      1. Ankit Vijay

        Hi Martin, it’s not documented. I came across this just today when I was trying add Authentication to my Azure function on Linux Consumption plan.. Windows based Consumption plan worked perfectly..

      2. Ankit Vijay

        Don’t see any way to share the screenshot else I could have share it with for reference.

        1. Martin Ehrnst

          Upload it somwhere and link it. I can check for my self later.

          1. ankitvijay

            It looks like I’m not able to share the link on comment as well.. What’s the best way to share the link with you?

          2. Martin Ehrnst

            Sorry. I forgot this. Ping me on linked in or Twitter

Comments are closed.