title: Restrict Access with Azure Managed Identity in .NET Core Web API
body: <p>My Azure Web App is calling my Azure API App endpoint. Both app services are in the same Azure subscription and RG. Web App is a .NET Core Web Application and API App is a .NET Core Web API. Web App is using standard HttpClient class to call the API App endpoint.</p>
  <p>I followed <a href="https://docs.microsoft.com/en-us/azure/app-service/overview-managed-identity?tabs=portal%2Cdotnet" rel="nofollow noreferrer">https://docs.microsoft.com/en-us/azure/app-service/overview-managed-identity?tabs=portal%2Cdotnet</a> and created a user-assigned managed identity. Then assigned this identity to the Azure API App with role as contributor.</p>
  <blockquote>
  <p>Web App still not assigned with the mentioned managed identity, but it
  can still access this API App without throwing the expected
  un-authorized error.</p>
  <p>My question is that how can I restrict that only this managed identity
  should access the mentioned API app? code middlweware or some other
  Azure settings?</p>
  </blockquote>