Merge pull request #234646 from saragluna/patch-2

Update the ASA calling Azure Func using MI authentication doc

Author: PMEds28

articles/spring-apps/media/spring-cloud-tutorial-managed-identities-functions/add-identity-provider.png renamed to articles/spring-apps/media/tutorial-managed-identities-functions/add-identity-provider.png

@@ -6,7 +6,7 @@ ms.author: margard
 ms.service: spring-apps
 ms.custom: event-tier1-build-2022, devx-track-java, devx-track-azurecli
 ms.topic: tutorial
-ms.date: 07/10/2020
+ms.date: 04/24/2023
 ---
 
 # Tutorial: Use a managed identity to invoke Azure Functions from an Azure Spring Apps app
@@ -25,7 +25,7 @@ Both Azure Functions and App Services have built in support for Azure Active Dir
 - An Azure subscription. If you don't have a subscription, create a [free account](https://azure.microsoft.com/free/) before you begin.
 - [Azure CLI](/cli/azure/install-azure-cli) version 2.45.0 or higher.
 - [Apache Maven](https://maven.apache.org/download.cgi) version 3.0 or higher.
-- [Install the Azure Functions Core Tools](../azure-functions/functions-run-local.md#install-the-azure-functions-core-tools) version 3.0.2009 or higher.
+- [Install the Azure Functions Core Tools](../azure-functions/functions-run-local.md#install-the-azure-functions-core-tools) version 4.x.
 
 ## Create a resource group
 
@@ -62,7 +62,7 @@ az functionapp create \
     --os-type windows \
     --runtime node \
     --storage-account <storage-account-name> \
-    --functions-version 3
+    --functions-version 4
 ```
 
 Make a note of the returned `hostNames` value, which is in the format *https://\<your-functionapp-name>.azurewebsites.net*. Use this value in the Function app's root URL for testing the Function app.
@@ -75,18 +75,28 @@ Use the following steps to enable Azure Active Directory authentication to acces
 1. In the navigation pane, select **Authentication** and then select **Add identity provider** on the main pane.
 1. On the **Add an identity provider** page, select **Microsoft** from the **Identity provider** dropdown menu.
 
-   :::image type="content" source="media/spring-cloud-tutorial-managed-identities-functions/add-identity-provider.png" alt-text="Screenshot of the Azure portal showing the Add an identity provider page with Microsoft highlighted in the identity provider dropdown menu." lightbox="media/spring-cloud-tutorial-managed-identities-functions/add-identity-provider.png":::
+   :::image type="content" source="media/tutorial-managed-identities-functions/add-identity-provider.png" alt-text="Screenshot of the Azure portal showing the Add an identity provider page with Microsoft highlighted in the identity provider dropdown menu." lightbox="media/tutorial-managed-identities-functions/add-identity-provider.png":::
 
 1. Select **Add**.
 1. For the **Basics** settings on the **Add an identity provider** page, set **Supported account types** to **Any Azure AD directory - Multi-tenant**.
 1. Set **Unauthenticated requests** to **HTTP 401 Unauthorized: recommended for APIs**. This setting ensures that all unauthenticated requests are denied (401 response).
 
-   :::image type="content" source="media/spring-cloud-tutorial-managed-identities-functions/identity-provider-settings.png" alt-text="Screenshot of the Azure portal showing the settings page for adding an identity provider. This page highlights the 'supported account types' setting set to the 'Any Azure AD directory Multi tenant' option and also highlights the 'Unauthenticated requests' setting set to the 'HTTP 401 Unauthorized recommended for APIs' option." lightbox="media/spring-cloud-tutorial-managed-identities-functions/identity-provider-settings.png":::
+   :::image type="content" source="media/tutorial-managed-identities-functions/identity-provider-settings.png" alt-text="Screenshot of the Azure portal showing the settings page for adding an identity provider. This page highlights the 'supported account types' setting set to the 'Any Azure AD directory Multi tenant' option and also highlights the 'Unauthenticated requests' setting set to the 'HTTP 401 Unauthorized recommended for APIs' option." lightbox="media/tutorial-managed-identities-functions/identity-provider-settings.png":::
 
 1. Select **Add**.
 
 After you add the settings, the Function app restarts and all subsequent requests are prompted to sign in through Azure AD. You can test that unauthenticated requests are currently being rejected with the Function app's root URL (returned in the `hostNames` output of the `az functionapp create` command). You should then be redirected to your organization's Azure Active Directory sign-in screen.
 
+You need the Application ID and the Application ID URI for later use. In the Azure portal, navigate to the Function app you created.
+
+To get the Application ID, select **Authentication** in the navigation pane, and then copy the **App (client) ID** value for the identity provider that includes the name of the Function app.
+
+:::image type="content" source="media/tutorial-managed-identities-functions/function-authentication.png" alt-text="Screenshot of the Azure portal showing the Authentication page for a Function app, with the Function app name highlighted in the Identity provider." lightbox="media/tutorial-managed-identities-functions/function-authentication.png":::
+
+To get the Application ID URI, select **Expose an API** in the navigation pane, and then copy the **Application ID URI** value.
+
+:::image type="content" source="media/tutorial-managed-identities-functions/function-expose-api.png" alt-text="Screenshot of the Azure portal showing the Expose an API page for a Function app with the Application ID URI highlighted." lightbox="media/tutorial-managed-identities-functions/function-expose-api.png":::
+
 ## Create an HTTP triggered function
 
 In an empty local directory, use the following commands to create a new function app and add an HTTP triggered function.
@@ -173,6 +183,7 @@ This sample invokes the HTTP triggered function by first requesting an access to
    ```text
    azure.function.uri=https://<function-app-name>.azurewebsites.net
    azure.function.triggerPath=httptrigger
+   azure.function.application-id.uri=<function-app-application-ID-uri>
    ```
 
 1. Use the following command to package your sample app.