Skip to main content

🚀 Short Notes on Azure Entra Authentication (Azure AD)

Azure Entra ID (formerly Azure Active Directory) is Microsoft’s cloud-based identity and access management (IAM) service. It helps secure apps, APIs, and services by managing authentication (who you are) and authorization (what you can do).

🔹 1. Key Concepts

  • Tenant: A dedicated instance of Entra ID for your organization.
  • App Registration: Register apps to integrate with Entra ID for authentication.
  • Authentication: Verifying user or service identity (via username, password, certificate, token).
  • Authorization: Granting permissions (roles/scopes) after authentication.
  • Tokens:
    • ID Token → User identity (used in login).
    • Access Token → Grants access to APIs.
    • Refresh Token → Get new tokens without logging in again.

🔹 2. Authentication Flows

  1. Authorization Code Flow (with PKCE) – Secure for web & mobile apps.
  2. Client Credentials Flow – Service-to-service authentication (no user).
  3. Device Code Flow – Used on devices without browsers (IoT, CLI).
  4. Implicit Flow (legacy) – Browser-based apps (now replaced by Auth Code + PKCE).

🔹 3. Integration in .NET

Add Entra authentication in ASP.NET Core API:

// Program.cs
builder.Services.AddAuthentication("Bearer")
    .AddMicrosoftIdentityWebApi(builder.Configuration.GetSection("AzureAd"));

Configure in appsettings.json:

"AzureAd": {
  "Instance": "https://login.microsoftonline.com/",
  "Domain": "yourdomain.onmicrosoft.com",
  "TenantId": "xxxx-xxxx-xxxx",
  "ClientId": "xxxx-xxxx-xxxx"
}

🔹 4. Authorization with Policies

builder.Services.AddAuthorization(options =>
{
    options.AddPolicy("ApiScope", policy =>
        policy.RequireAuthenticatedUser()
              .RequireClaim("scp", "access_as_user"));
});

🔹 5. Security Features

  • Conditional Access → Enforce MFA, device compliance.
  • Identity Protection → Detect risky sign-ins.
  • Role-Based Access Control (RBAC) → Assign roles like Reader, Contributor, Admin.
  • App Roles & Scopes → Fine-grained access control for apps.

🔹 6. Common Use Cases

✅ Single Sign-On (SSO) for apps
✅ API protection with OAuth 2.0 & OpenID Connect
✅ B2C (Business-to-Consumer) authentication
✅ Enterprise federation with external providers (Google, Facebook, etc.)

🔹 7. Best Practices

  • Always use Authorization Code + PKCE for SPAs.
  • Use Managed Identities for Azure resources (no secrets).
  • Regularly rotate client secrets or use certificates.
  • Enable MFA + Conditional Access for stronger security.

✨ In short: Azure Entra Auth secures your applications with modern identity standards (OAuth 2.0, OpenID Connect). It supports users, apps, and services with SSO, tokens, roles, and conditional access to build enterprise-grade secure solutions. 

Comments

Post a Comment

Popular posts from this blog

☁️ Azure Key vault Short Notes

🟢 What is Azure Key Vault? A cloud service for securely storing and accessing secrets, keys, and certificates . Removes the need to keep secrets (like connection strings, passwords, API keys) inside code or config files. Provides centralized secret management, encryption, and access control . 👉 Think of it like a secure password manager but for your applications. 🟢 Key Features Secrets → store text values (e.g., DB connection string, API key). Keys → store cryptographic keys (RSA, EC) for encryption, signing. Certificates → store/manage SSL/TLS certificates. Access Control → Access Policies (older model). Azure RBAC (modern, preferred). Integration → works with App Service, Functions, AKS, VMs, SQL DB, etc. Logging → audit who accessed secrets via Azure Monitor / Diagnostic Logs. 🟢 Why Use Key Vault? Security → secrets are encrypted with HSM (Hardware Security Modules). Compliance → meet industry standards (PCI-DSS, ISO, GDPR). Automation → aut...
Post a Comment
Read more

🗑️ Garbage Collection & Resource Management in .NET (C#) — Beginner Friendly Guide

When you start working with .NET and C#, one of the biggest advantages is that you don’t need to manually manage memory like in C or C++. The Garbage Collector (GC) does most of the work for you. But here’s the catch — not everything is managed automatically. Some resources like files, database connections, sockets, and native memory still need special handling. This blog will help you understand: ✔ How the GC works ✔ What are managed vs unmanaged resources ✔ The difference between Dispose , Finalize , and using ✔ The Dispose pattern with examples ✔ Best practices every C# developer should know 1) How Garbage Collection Works in .NET Managed resources → Normal .NET objects (string, List, etc.). GC frees them automatically. Unmanaged resources → External resources like file handles, database connections, sockets, native memory. GC cannot clean them up — you must do it. 👉 GC uses a Generational Model for performance: Gen 0 : Short-lived objects (local variables, t...
Post a Comment
Read more

🚀 Onboard a New API in Microsoft Entra and Consume It — with Full Examples

This article shows how to: Register your API in Microsoft Entra (Azure AD) and expose a scope. Register clients (daemon and web client) and grant permissions. Protect a .NET Web API (ASP.NET Core) using Microsoft.Identity.Web . Call the API from: a daemon/service using client credentials a backend that performs On-Behalf-Of (OBO) to call a downstream API Replace placeholders like YOUR_TENANT_ID , API_CLIENT_ID , CLIENT_APP_ID , and CLIENT_SECRET with actual values from the portal. ✳️ Portal steps (brief) Register API ( MyProductApi ) Azure Portal → Microsoft Entra ID → App registrations → New registration → MyProductApi Note: Application (client) ID → API_CLIENT_ID , Directory (tenant) ID → YOUR_TENANT_ID Expose an API App → Expose an API → Set Application ID URI to api://{API_CLIENT_ID} (default) or https://contoso.com/my-api Add a scope : Scope name: access_as_user Admin consent display name: Access MyProductApi as user Who can consent: Admins a...
Post a Comment
Read more