Get AccessToken by using System Assigned Managed Identity

Prakash Rajan 1 Reputation point
2021-05-05T13:01:28.16+00:00

I have a function app which calls APIM and APIM have validate JWT token policy. I have assigned a managed Identity(system assigned). I want to generate access token so that I can utilize the jwt token validation. for that I tried to use the below code which is the sample given for key vault. what will be the equivalent for my case?

var tokenCredential = new DefaultAzureCredential();
var accessToken = await tokenCredential.GetTokenAsync(
new TokenRequestContext(scopes: new string[] { "https://vault.azure.net" + "/.default" }) { });

right now its able to fetch the token when I pass https://vault.azure.net. but I am generating the token for APIM what should I add here to get the token, so that I can validate audience in authentication policy in APIM.

var accessToken = await tokenCredential.GetTokenAsync(
new TokenRequestContext(scopes: new string[] { "--APIM?--" + "/.default" }) { });

My end goal is to Function app will generate access token and add it as part of the header to its rest api call to APIM. APIM will validate with validate_jwt policy.

Azure API Management
Azure API Management
An Azure service that provides a hybrid, multi-cloud management platform for APIs.
1,751 questions
Azure Functions
Azure Functions
An Azure service that provides an event-driven serverless compute platform.
4,263 questions
Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
19,468 questions
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Pramod Valavala 20,516 Reputation points Microsoft Employee
    2021-05-13T06:36:05.273+00:00

    @Prakash Rajan You must use the Application ID URI of the resource that you need a token for. This can be found in the overview blade of your app registration which is exposing the API. You would have setup this up when configuring scopes.

    Depending on your requirements, you would also want to setup Application Roles.