title: Securing ASPNET Core Web API for calls from Azure Function
body: <p>We have an exisiting ASP.NET Core Web Api in Azure that has endpoints that support Azure AD and Azure AD secured users</p>
  <p>I want to create a new Azure Function with a Timed trigger that will call this same Web Api. The call will obviously not be in the context of a user but in the context of the Function App.</p>
  <p>The AF is AzureFunctionsVersion &quot;v3&quot; with a TargetFramework of &quot;netcoreapp3.1&quot;</p>
  <p>I have added an App Role to the App registration for the existing Web API</p>
  <p><a href="https://i.stack.imgur.com/NYWZQ.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/NYWZQ.png" alt="App Role exposed from Web Api" /></a></p>
  <p>I have then requested access to the that API from the Azure Functions &quot;Api Permissions&quot; blade in Azure Portal</p>
  <p><a href="https://i.stack.imgur.com/uwXCT.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/uwXCT.png" alt="API's App Role granted" /></a></p>
  <p>I am only running this Azure Function locally as yet so here are the values from local.settings.json. I've removed the real values</p>
  <pre><code>{
    &quot;IsEncrypted&quot;: false,
    &quot;Values&quot;: {
      &quot;AzureWebJobsStorage&quot;: &quot;UseDevelopmentStorage=true&quot;,
      &quot;FUNCTIONS_WORKER_RUNTIME&quot;: &quot;dotnet&quot;,
      &quot;AzureAd:Instance&quot;: &quot;https://login.microsoftonline.com/&quot;,
      &quot;AzureAd:Domain&quot;: &quot;ourdomain.co.uk&quot;,
      &quot;AzureAd:TenantId&quot;: &quot;aaaaaaaa-92eb-430b-b902-aaaaaaaaaaaa&quot;,
      &quot;AzureAd:ClientId&quot;: &quot;aaaaaaaa-bd17-4e69-bdf6-aaaaaaaaaaaa&quot;,
      &quot;AzureAd:Audience&quot;: &quot;https://ourdomain.co.uk/appid,
      &quot;AzureAd:ClientSecret&quot;: &quot;THESECRET&quot;,
      &quot;PatientApi:BaseAddress&quot;: &quot;https://myapi.com/api/&quot;,
      &quot;PatientApi:Scopes&quot;: &quot;https://my-api-appiduri/.default&quot;
    },
  }  
  </code></pre>
  <p>I then try an get a token for the Azure Function  by calling GetAccessTokenForAppAsync</p>
  <pre><code> var accessToken = await this.tokenAcquisition.GetAccessTokenForAppAsync(this.patientScope);
              
   this.httpClient.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue(&quot;Bearer&quot;, accessToken);
   this.httpClient.DefaultRequestHeaders.Accept.Add(new MediaTypeWithQualityHeaderValue(&quot;application/json&quot;));
  </code></pre>
  <p>When I call GetAccessTokenForAppAsync I get the following Exception</p>
  <blockquote>
  <p>Microsoft.Identity.Client.MsalServiceException: 'A configuration issue
  is preventing authentication - check the error message from the server
  for details. You can modify the configuration in the application
  registration portal. See <a href="https://aka.ms/msal-net-invalid-client" rel="nofollow noreferrer">https://aka.ms/msal-net-invalid-client</a> for
  details.  Original exception: AADSTS7000215: Invalid client secret
  provided. Ensure the secret being sent in the request is the client
  secret value, not the client secret ID, for a secret added to app
  '{CLIENTID_FOR_AZUREFUNCTION}'.</p>
  </blockquote>
  <p>Is this AzureAd config and calling GetAccessTokenForAppAsync the right approach?</p>