title: Azure AD: Call .net Core Web API from other .net Core Web API
body: <p>I have a situation where there is a .net Core Web API that we use to manage some "machines".
  One of the exposed API is a simulation of the operation of such machines.
  The machines have different versions, each different versions have a different internal behavior but same interface.</p>
  
  <p>We have, then, developed a series of different .net Core Web API to simulate each different versions of the machines.</p>
  
  <p>I need therefore to call an API from an API, it's sound pretty straightforward as I'm doing it already with <em>Microsoft Graph</em>.</p>
  
  <p>In startup.cs, I have:</p>
  
  <pre><code>public void ConfigureServices(IServiceCollection services)
  {
      // To protect the API with Azure AD
      services
          .AddProtectedWebApi(Configuration);
  
      // To have ITokenAcquisition when calling the specific simulation API
      services
          .AddMicrosoftIdentityPlatformAuthentication(Configuration)
          .AddMsal(Configuration, new string[] { Configuration["SimulationAPIv411:Scope"] })
          .AddInMemoryTokenCaches();
  </code></pre>
  
  <p>I'm testing it with Postman with this flow in mind:</p>
  
  <ol>
  <li>I get a bearer token with Postman to access the generic API</li>
  <li>Postman call the SimulationDispatcherController in the generic API</li>
  <li>The SimulationDispatcherController calls the specific simulation API</li>
  <li>The result flow back to Postman</li>
  </ol>
  
  <p>What I'm experiencing is:</p>
  
  <ol>
  <li><p>If I leave it like this, in postman I get as result a login page</p>
  
  <pre><code>&lt;!-- Copyright (C) Microsoft Corporation. All rights reserved. --&gt;
  &lt;!DOCTYPE html&gt;
  &lt;html dir="ltr" class="" lang="en"&gt;
  
  &lt;head&gt;
      &lt;title&gt;Sign in to your account&lt;/title&gt;
  [...]
  </code></pre></li>
  <li><p>If I remove the line <code>.AddMicrosoftIdentityPlatformAuthentication(Configuration)</code> then I can reach the SimulationDispatcherController but when it tries to call the other API I get the error:</p>
  
  <pre><code>MSAL.NetCore.4.8.1.0.MsalUiRequiredException: 
  ErrorCode: user_null
  Microsoft.Identity.Client.MsalUiRequiredException: No account or login hint was passed to the AcquireTokenSilent call.
  [...]
  </code></pre>
  
  <p>I try to get the token with the <code>ITokenAcquisition</code> object, calling <code>GetAccessTokenOnBehalfOfUserAsync(_Scopes);</code> where the scope is the required one for the specific API.</p></li>
  </ol>
  
  <p>Do you have any suggestion or link to documentation that explain better how to configure the MSAL in an API that is protected by Azure AD?</p>
  
  <p><strong>EDIT:</strong>
  As suggested in the answer, the only change required was:</p>
  
  <pre><code>.AddMsal(Configuration, new string[] { Configuration["SimulationAPIv411:Scope"] })
  </code></pre>
  
  <p>to</p>
  
  <pre><code>.AddProtectedApiCallsWebApis(Configuration)
  </code></pre>