Skip to main content

🚀 Short Notes on Azure Entra Authentication (Azure AD)

Azure Entra ID (formerly Azure Active Directory) is Microsoft’s cloud-based identity and access management (IAM) service. It helps secure apps, APIs, and services by managing authentication (who you are) and authorization (what you can do).

🔹 1. Key Concepts

  • Tenant: A dedicated instance of Entra ID for your organization.
  • App Registration: Register apps to integrate with Entra ID for authentication.
  • Authentication: Verifying user or service identity (via username, password, certificate, token).
  • Authorization: Granting permissions (roles/scopes) after authentication.
  • Tokens:
    • ID Token → User identity (used in login).
    • Access Token → Grants access to APIs.
    • Refresh Token → Get new tokens without logging in again.

🔹 2. Authentication Flows

  1. Authorization Code Flow (with PKCE) – Secure for web & mobile apps.
  2. Client Credentials Flow – Service-to-service authentication (no user).
  3. Device Code Flow – Used on devices without browsers (IoT, CLI).
  4. Implicit Flow (legacy) – Browser-based apps (now replaced by Auth Code + PKCE).

🔹 3. Integration in .NET

Add Entra authentication in ASP.NET Core API:

// Program.cs
builder.Services.AddAuthentication("Bearer")
    .AddMicrosoftIdentityWebApi(builder.Configuration.GetSection("AzureAd"));

Configure in appsettings.json:

"AzureAd": {
  "Instance": "https://login.microsoftonline.com/",
  "Domain": "yourdomain.onmicrosoft.com",
  "TenantId": "xxxx-xxxx-xxxx",
  "ClientId": "xxxx-xxxx-xxxx"
}

🔹 4. Authorization with Policies

builder.Services.AddAuthorization(options =>
{
    options.AddPolicy("ApiScope", policy =>
        policy.RequireAuthenticatedUser()
              .RequireClaim("scp", "access_as_user"));
});

🔹 5. Security Features

  • Conditional Access → Enforce MFA, device compliance.
  • Identity Protection → Detect risky sign-ins.
  • Role-Based Access Control (RBAC) → Assign roles like Reader, Contributor, Admin.
  • App Roles & Scopes → Fine-grained access control for apps.

🔹 6. Common Use Cases

✅ Single Sign-On (SSO) for apps
✅ API protection with OAuth 2.0 & OpenID Connect
✅ B2C (Business-to-Consumer) authentication
✅ Enterprise federation with external providers (Google, Facebook, etc.)

🔹 7. Best Practices

  • Always use Authorization Code + PKCE for SPAs.
  • Use Managed Identities for Azure resources (no secrets).
  • Regularly rotate client secrets or use certificates.
  • Enable MFA + Conditional Access for stronger security.

✨ In short: Azure Entra Auth secures your applications with modern identity standards (OAuth 2.0, OpenID Connect). It supports users, apps, and services with SSO, tokens, roles, and conditional access to build enterprise-grade secure solutions. 

Comments

Post a Comment

Popular posts from this blog

🏗️ Deep Dive: Understanding Every Concept in Microsoft Entra API Onboarding for .NET Developers

When working with Microsoft Entra (formerly Azure Active Directory), you’ll hear terms like App Registration, Tenant, Client ID, Audience, Scopes, Roles, Tokens, OBO flow , and more. If you’re new, it can feel overwhelming. This guide breaks down every key term and concept , with definitions, examples, and how they connect when you onboard and consume a new API. 🔹 1. Tenant Definition : A tenant in Entra ID is your organization’s dedicated, isolated instance of Microsoft Entra. Think of it like : Your company’s identity directory. Example : contoso.onmicrosoft.com is a tenant for Contoso Ltd. 🔹 2. App Registration Definition : The process of registering an application in Entra to give it an identity and permission to use Microsoft identity platform. Why needed : Without registration, Entra doesn’t know about your app. What it creates : Application (Client) ID – unique identifier for your app Directory (Tenant) ID – your organization’s ID Types of apps : Web ...
Post a Comment
Read more

🗑️ Garbage Collection & Resource Management in .NET (C#) — Beginner Friendly Guide

When you start working with .NET and C#, one of the biggest advantages is that you don’t need to manually manage memory like in C or C++. The Garbage Collector (GC) does most of the work for you. But here’s the catch — not everything is managed automatically. Some resources like files, database connections, sockets, and native memory still need special handling. This blog will help you understand: ✔ How the GC works ✔ What are managed vs unmanaged resources ✔ The difference between Dispose , Finalize , and using ✔ The Dispose pattern with examples ✔ Best practices every C# developer should know 1) How Garbage Collection Works in .NET Managed resources → Normal .NET objects (string, List, etc.). GC frees them automatically. Unmanaged resources → External resources like file handles, database connections, sockets, native memory. GC cannot clean them up — you must do it. 👉 GC uses a Generational Model for performance: Gen 0 : Short-lived objects (local variables, t...
Post a Comment
Read more

☁️ Azure Key vault Short Notes

🟢 What is Azure Key Vault? A cloud service for securely storing and accessing secrets, keys, and certificates . Removes the need to keep secrets (like connection strings, passwords, API keys) inside code or config files. Provides centralized secret management, encryption, and access control . 👉 Think of it like a secure password manager but for your applications. 🟢 Key Features Secrets → store text values (e.g., DB connection string, API key). Keys → store cryptographic keys (RSA, EC) for encryption, signing. Certificates → store/manage SSL/TLS certificates. Access Control → Access Policies (older model). Azure RBAC (modern, preferred). Integration → works with App Service, Functions, AKS, VMs, SQL DB, etc. Logging → audit who accessed secrets via Azure Monitor / Diagnostic Logs. 🟢 Why Use Key Vault? Security → secrets are encrypted with HSM (Hardware Security Modules). Compliance → meet industry standards (PCI-DSS, ISO, GDPR). Automation → aut...
Post a Comment
Read more