title: Authenticate Azure AD User to multiple backend services
body: <p>I'm trying to find a strategy for authorizing a web client that makes HTTP calls to two services hosted in Azure. The web client is all client-side, and the two API Services are Azure Functions hosted in Azure.</p>
  <p>For each of the three mentioned apps, I have setup an App Registration in Azure AD and exposed the scopes for the two Azure Functions applications to the web client to allow the client to make calls to them. I have also setup app roles for the two API applications and assigned those roles to a user.</p>
  <p>The current setup works very well when the web client makes a single call to each API service. However, I want the web client to make a call to Service A, and then Service A makes an HTTP call to Service B using the credentials of the user of the web client. From what I see, when the web client makes a call to Service A, the token given to the web client only has the Scope and Role for Service A, and nothing for Service B.</p>
  <p>My question is, what is the recommended strategy for allowing the user's credentials to be passed along to an internal service? Especially when the original token doesn't have the credentials for the extra service.</p>
  <p>I did find this question (<a href="https://stackoverflow.com/questions/56547808/app-service-to-app-service-auth-in-azure-using-managed-identity">App service to app service auth in Azure using Managed Identity</a>), which is very close to what I'm trying to accomplish. The marked answer seems to imply that my own application is responsible for generating a new token to the extra service, but I'm not sure which application is responsible for that. Is the recommendation that the web client make a separate request to acquire the token to Service B, and in the HTTP Request to Service A, include the token to Service B in the request body when making the call?</p>