Authentication

Context I recently realized that my understanding of how JWTs are validated was incorrect. I thought the flow worked like this: The client presents its credentials to Entra ID and gets a JWT for a specific aud (audience). The client then presents that JWT to the resource — an API, for example. The API, after receiving the token, presents it back to Entra ID for validation: essentially asking, “Is this token actually valid and untampered?” Upon successful validation by Entra ID, the API would then check the claims and, if they check out, allow the client to access the API. ...

Recently, while setting up a Function App to use User Assigned Managed Identity (UAMI) to authenticate to its AzureWebJobsStorage I encountered SyncTriggerfailure. I checked whether the UAMI had necessary RBAC roles to work on AzureWebJobsStorage — it had. So, I wasn’t sure what the issue was. Analyzing further, I realized I had skipped a few mandatory variable settings to enable UAMI based authentication to AzureWebJobsStorage (setting the environment variable AzureWebJobsStorage__accountName alone does not suffice) ...

This guide outlines the process for assigning application roles to a Managed Identity (MI) in Entra ID. It covers observed behaviors, inherent limitations, and the necessary steps required when an MI must authenticate with another application (such as an API in APIM) using role-based access control (RBAC). Scenario In a typical architecture, a Logic App utilizes a Managed Identity (either System-Assigned or User-Assigned) to communicate with downstream resources. When that Logic App needs to call an API exposed via APIM, the following requirements usually apply: ...

Symptom Calling Azure Table Storage REST API returns: 403 Server failed to authenticate the request. Make sure the value of Authorization header is formed correctly including the signature. Even though Authorization header looks valid Root Cause The request is missing x-ms-version header Azure Storage requires this header to determine the API version used for request validation. Without it, the service may reject the request with a misleading authentication error. Fix Add header ...