Hi, Is there a way to restrict which resources (particularly APIM instances) using managed identity can integrate with an Azure Function protected by Azure AD authentication? Basically we've performed the following steps to integrate the APIM with the Azure Function: Configured the Azure Function to use Azure AD login, as per docs Enabled Managed Identity on the API Management resources as per docs However it's not clear how to disable any other API Management resource follow step 2 and integrate with the function? Thank you, Cosmin

@Cosmin Stirbu This is a service-to-service call and can be authorized via app roles . This section of the docs describes the steps required. This would need validation in your function app.

Integrate Azure API Management with Azure Functions using Managed Identity and Active Directory Authentication

Cosmin Stirbu 151

Hi,

Is there a way to restrict which resources (particularly APIM instances) using managed identity can integrate with an Azure Function protected by Azure AD authentication?

Basically we've performed the following steps to integrate the APIM with the Azure Function:

Configured the Azure Function to use Azure AD login, as per docs
Enabled Managed Identity on the API Management resources as per docs

However it's not clear how to disable any other API Management resource follow step 2 and integrate with the function?

Thank you,
Cosmin

1 answer

Pramod Valavala 20,591 Reputation points Microsoft Employee

2021-06-21T09:33:47.127+00:00

@Cosmin Stirbu This is a service-to-service call and can be authorized via app roles. This section of the docs describes the steps required. This would need validation in your function app.
Please sign in to rate this answer.
Cosmin Stirbu 151 Reputation points

2021-06-23T06:03:04.693+00:00

Does this mean that we should/can drop the Managed Identity integration between API Management and the Azure Function?

Currently we don't perform token / claims validation at the function level.

We perform the token / claims validation at the API Management level using validate-jwt policy, and then we use authentication-managed-identity to allow API Management to access the Azure Function.

Pramod Valavala 20,591 Reputation points Microsoft Employee

2021-06-23T06:20:27.623+00:00

@Cosmin Stirbu If all requests go through APIM, then you could skip it at the function app level and just protect your function app with IP Restrictions instead to allow requests to only come from APIM.

Cosmin Stirbu 151 Reputation points

2021-06-23T08:17:39.683+00:00

We'll use IP restrictions then to allow requests to only come from APIM. Thank you.
Sign in to comment