title: Azure API Management + Azure Function and managed identity
body: <p>I'm trying to call an Azure function from an API Management instance by using Managed Identity.
  I have set a System Managed Identity to my APIM instance.
  I have granted the Contributor role to this identity on the Azure Function App.
  I have also change the App Service Authentication to AD.</p>
  
  <p>Now I'm trying to call the function from an API.</p>
  
  <p>I have two issues:</p>
  
  <ol>
  <li>First One: when I use the authentication-managed-identity policy to get a token, I got an error when I use the audience <a href="https://myfunctionapp.azurewebsites.net" rel="nofollow noreferrer">https://myfunctionapp.azurewebsites.net</a>. AD tells me that this app is not registered in the tenant</li>
  <li>Second: If I retrieve a token for <a href="https://management.azure.com" rel="nofollow noreferrer">https://management.azure.com</a>, I got a token but I received a 401 Unauthorized error from the Azure Function.</li>
  </ol>
  
  <p>Maybe I'm just trying to get a token on the wrong audience, but unfortunately the audience of functions is not listed in the document (for service bus for example, there is a common URI to use, also for KeyVault, ...).</p>
  
  <p>I think that I probably missed something in the picture...
  Thanks.</p>