How can I use an Azure AD login for my .NET API?

I have a .NET 7 API that requires the user to have a Microsoft account. So to make it easier for the customer I want them to be able to login with their Microsoft account. The target audience is big organizations that often block their users from giving permissions to new apps. The simplest way I found to do this was to simply log the user in with only the "email" permission of the Microsoft Graph API.

I will briefly explain the current setup:

• I registered an AD app called "MyApi" in our Azure AD. It's open for all organizations and only has one permission: "email" (from Microsoft Graph API).
• I added a button to my front-end web app that sends the user to https://login.microsoftonline.com/common/oauth2/authorize?client_id=[MyApi.ClientId]&redirect_uri=[MyApi.RedirectUri]&response_type=code&prompt=consent&scope=offline_access&response_mode=query
• I then exchange the code for a token using the https://login.microsoftonline.com/common/oauth2/token endpoint with scope = "offline_access".
• I then receive a token that has the audience: 00000002-0000-0000-c000-000000000000 (which is the Microsoft Graph API) and appId: MyApi.ClientId
• In the startup class I then do this:

IConfigurationSection azureAdSection = _configuration.GetSection("AzureAd");
azureAdSection.GetSection("Instance").Value = "https://login.microsoftonline.com/";
azureAdSection.GetSection("Audience").Value = "00000002-0000-0000-c000-000000000000";
azureAdSection.GetSection("ClientId").Value = MyApi.ClientId;
azureAdSection.GetSection("ClientSecret").Value = MyApi.ClientSecret;
azureAdSection.GetSection("TenantId").Value = "organizations";
services.AddMicrosoftIdentityWebApiAuthentication(_configuration, "AzureAd");

I first tried it with a second Azure AD App that had exposed permission which I then used in the MyApi app. But this caused Azure AD Errors like this one:

AADSTS650052: The app is trying to access a service MySecondApp.ClientId that your organization [My TenantID]
lacks a service principal for.
Contact your IT Admin to review the configuration of your service subscriptions or consent
to the application in order to create the required service principal.

We then came to the conclusion that we probably don't even need this second app.

With the current setup everything seems to work fine, but is it the correct way?

By doing this I have a token that guarantees me that the user is a Microsoft user (which is reliable) and I can see what their email and id is. This data will allow me to find the matching user in our database and return the requested response. I have no need for custom scopes as all authorization and permissions are handled by the API itself.

In other posts and documentation there is a need for custom scopes or for using the token to call a downstream API (often the Graph API itself), all which isn't needed here.

What you have is an .Net 7 webapi, and you had services.AddMicrosoftIdentityWebApiAuthentication(_configuration, "AzureAd"); in your startup file, so you are now using Azure AD to protect your API. This protect means when a request reaching your API, it must contain a correct Bearer access_token in the request header. Here the correct means it should have correct audience, client id, scope/role, and it must be valid/not expired, etc.

So you have to have an Azure AD application(you already have it) and expose an API, then you can assign this API permission to this application(so that you don't have to create another AAD app). Then in your frontend application, you need to generate access token via this AAD app and setting the scope with the value you exposed just now, the value should looks like api://client_id/permission_name. Then the token should have "aud": "api://client_id", and have "scp": "permission_name",. And this token should be able to bypass the validation of your web API.

In your API permission, you should have code and configurations like this:

    builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
    .AddMicrosoftIdentityWebApi(builder.Configuration.GetSection("AzureAd"));

  "AzureAd": {
    "Instance": "https://login.microsoftonline.com/",
    "ClientId": "aad_client_id",
    "ClientSecret": "client_secret",
    "TenantId": "organizations", // A guid (Tenant ID = Directory ID) or 'common' or 'organizations' or 'consumers'
    "Audience": "api://aad_client_id"
  },

To generate such kind of access token, you have to let user sign in first with MSAL. If your client app is written in react, maybe you can take a look at this answer. Please note you need to set the scope to api://client_id/permission_name to generate a token containing this scope.