|
| 1 | +--- |
| 2 | +title: Protect Access to Product APIs with Microsoft Entra Application - Azure API Management |
| 3 | +titleSuffix: Azure API Management |
| 4 | +description: Configure OAuth 2.0 access to product APIs in Azure API Management with Microsoft Entra ID applications. |
| 5 | +services: api-management |
| 6 | +author: dlepow |
| 7 | + |
| 8 | +ms.service: azure-api-management |
| 9 | +ms.topic: how-to |
| 10 | +ms.date: 05/19/2025 |
| 11 | +ms.author: danlep |
| 12 | +ms.custom: |
| 13 | +--- |
| 14 | +# Secure product API access with Microsoft Entra applications |
| 15 | + |
| 16 | +[!INCLUDE [api-management-availability-premium-dev-standard-basic](../../includes/api-management-availability-premium-dev-standard-basic.md)] |
| 17 | + |
| 18 | +API Management now supports built-in OAuth 2.0 application-based access to product APIs using the client credentials flow. This feature allows API managers to register Microsoft Entra ID applications, streamlining secure API access for developers through OAuth 2.0 authorization. |
| 19 | + |
| 20 | +> [!NOTE] |
| 21 | +> Applications are currently in limited preview. To sign up, fill [this form](https://aka.ms/apimappspreview). |
| 22 | +
|
| 23 | +With this feature: |
| 24 | + |
| 25 | +* API managers set a product property to enable application-based access. |
| 26 | +* API managers register client applications in Microsoft Entra ID to limit access to specific products. |
| 27 | +* Using the OAuth 2.0 client credentials flow, developers or apps obtain tokens that they can include in API requests |
| 28 | +* Tokens presented in API requests are validated by the API Management gateway to authorize access to the product's APIs. |
| 29 | + |
| 30 | +## Prerequisites |
| 31 | + |
| 32 | +- An API Management instance deployed in the **Premium**, **Standard**, **Basic**, or **Developer** tier. If you need to deploy an instance, see [Create an API Management service instance](get-started-create-service-instance.md). |
| 33 | + |
| 34 | +- At least one product in your API Management instance, with at least one API assigned to it. |
| 35 | + * The product should be in the **Published** state so that it can be accessed by developers through the developer portal. |
| 36 | + * For testing, you can use the default **Starter** product and the **Echo** API that's added to it. |
| 37 | + * If you want to create a product, see [Create and publish a product](api-management-howto-add-products.md). |
| 38 | + |
| 39 | +- Sufficient permissions in your Microsoft Entra tenant to assign the **Application Administrator** role, which requires at least the **Privileged Role Administrator** role. |
| 40 | + |
| 41 | +- Optionally, add one or more [users](api-management-howto-create-or-invite-developers.md) in your API Management instance. |
| 42 | + |
| 43 | +[!INCLUDE [azure-powershell-requirements-no-header](~/reusable-content/ce-skilling/azure/includes/azure-powershell-requirements-no-header.md)] |
| 44 | + |
| 45 | +## Configure managed identity |
| 46 | + |
| 47 | + 1. Enable a system-assigned [managed identity for API Management](api-management-howto-use-managed-service-identity.md) in your API Management instance. |
| 48 | + |
| 49 | +1. Assign the identity the **Application Administrator** RBAC role in Microsoft Entra ID. To assign the role: |
| 50 | + |
| 51 | + 1. Sign in to the [portal](https://portal.azure.com) and navigate to **Microsoft Entra ID**. |
| 52 | + 1. In the left menu, select **Manage** > **Roles and administrators**. |
| 53 | + 1. Select **Application administrator**. |
| 54 | + 1. In the left menu, select **Manage** > **Assignments** > **+ Add assignments**. |
| 55 | + 1. In the **Add assignments** page, search for the API Management instance's managed identity by name (the name of the API Management instance). Select the managed identity, and then select **Add**. |
| 56 | + |
| 57 | +## Enable application based access for product |
| 58 | + |
| 59 | +Follow these steps to enable **Application based access** for a product. A product must have this setting enabled to be associated with a client application in later steps. |
| 60 | + |
| 61 | +The following example uses the **Starter** product, but choose any published product that has at least one API assigned to it. |
| 62 | + |
| 63 | +1. Sign in to the [portal](https://portal.azure.com) and navigate to your API Management instance. |
| 64 | +1. In the left menu, under **APIs**, select **Products**. |
| 65 | +1. Choose the product that you want to configure, such as the **Starter** product. |
| 66 | +1. In the left menu, under **Product**, select **Properties**. |
| 67 | +1. Enable the **Application based access** setting. |
| 68 | +1. Optionally, enable the **Requires subscription** setting. If you enable both application based access and a subscription requirement, the API Management gateway can accept either OAuth 2.0 authorization or a subscription key for access to the product's APIs. |
| 69 | +1. Select **Save**. |
| 70 | + |
| 71 | +:::image type="content" source="media/applications/enable-application-based-access.png" alt-text="Screenshot of enabling application based access in the portal."::: |
| 72 | + |
| 73 | +> [!TIP] |
| 74 | +> You can also enable the **Application based access** setting when creating a new product. |
| 75 | +
|
| 76 | + Enabling application based access creates a backend enterprise application in Microsoft Entra ID to represent the product. The backend application ID is displayed in the product's **Properties** page. |
| 77 | + |
| 78 | +:::image type="content" source="media/applications/product-application-settings.png" alt-text="Screenshot of product's application settings in the portal."::: |
| 79 | + |
| 80 | +> [!NOTE] |
| 81 | +> This application ID is set as the **Audience** value when creating a client application to access the product. Also use this value when generating a token to call the product API. |
| 82 | +> |
| 83 | +
|
| 84 | +## (Optional) Review product application settings in Microsoft Entra ID |
| 85 | + |
| 86 | +Optionally review settings of the backend enterprise application created in Microsoft Entra ID to represent the product. |
| 87 | + |
| 88 | +The application is named with the following format: **APIMProductApplication\<product-name\>**. For example, if the product name is **Starter**, the application name is **APIMProductApplicationStarter**. The application has an **App role** defined. |
| 89 | + |
| 90 | +To review application settings in **App registrations**: |
| 91 | + |
| 92 | +1. Sign in to the [portal](https://portal.azure.com) and navigate to **Microsoft Entra ID** > **Manage** > **App registrations**. |
| 93 | +1. Select **All applications**. |
| 94 | +1. Search for and select the application created by API Management. |
| 95 | +1. In the left menu, under **Manage**, select **App roles**. |
| 96 | +1. Confirm the application role that set by Azure API Management, as shown in the following screenshot: |
| 97 | + |
| 98 | +:::image type="content" source="media/applications/application-roles.png" alt-text="Screenshot of app roles in the portal."::: |
| 99 | + |
| 100 | +## Register client application to access product |
| 101 | + |
| 102 | +Now register a client application that limits access to one or more products. |
| 103 | + |
| 104 | +* A product must have **Application based access** enabled to be associated with a client application. |
| 105 | +* Each client application has a single user (owner) in the API Management instance. One the owner can access product APIs through the application. |
| 106 | +* A product can be associated with more than one client application. |
| 107 | + |
| 108 | +1. Sign in to the [portal](https://portal.azure.com) and navigate to your API Management instance. |
| 109 | +1. In the left menu, under **APIs**, select **Applications** > **+ Register application**. |
| 110 | +1. In the **Register an application** page, enter the following application settings: |
| 111 | + * **Name**: Enter a name for the application. |
| 112 | + * **Owner**: Select the owner of the application from the dropdown list of users in the API Management instance. |
| 113 | + * **Grant access to selected products**: Select one or more products in the API Management instance that were previously enabled for **Application based access**. |
| 114 | + * **Description**: Optionally enter a description. |
| 115 | + |
| 116 | + :::image type="content" source="media/applications/register-application.png" alt-text="Screenshot of application settings in the portal."::: |
| 117 | +1. Select **Register**. |
| 118 | + |
| 119 | +The application is added to the list of applications on the **Applications** page. Select the application to view details such as the **Client ID**. You need this ID to generate a token to call the product API. |
| 120 | + |
| 121 | +> [!TIP] |
| 122 | +> * After creating an application, optionally associate it with other products. Select the application on the **Applications** page, and then select **Details** > **Products** > **+ Add product**. |
| 123 | +> * You can also create or associate an application by editing a product from the **Products** page. |
| 124 | +
|
| 125 | +## Generate client secret |
| 126 | + |
| 127 | +A client secret must be generated for the client application to use the OAuth 2.0 client credentials flow. The secret is valid for one year but can be regenerated at any time. |
| 128 | + |
| 129 | +1. On the **Applications** page, select the application that you created. |
| 130 | +1. On the application's **Overview** page, next to **Client Secret**, select **Add secret**. |
| 131 | +1. On the **New client secret** page, select **Generate**. |
| 132 | + |
| 133 | + A client secret is generated and displayed in the **Client secret** field. Make sure to copy the secret value and store it securely. You won't be able to retrieve it again after you close the page. |
| 134 | +1. Select **Close**. |
| 135 | + |
| 136 | +## (Optional) Review client application settings in Microsoft Entra ID |
| 137 | + |
| 138 | +Optionally review settings of the client application in Microsoft Entra ID. |
| 139 | + |
| 140 | +The application is named with the following format: **APIMApplication\<product-name\>**. For example, if the product name is **Starter**, the application name is similar to **APIMApplicationStarter**. |
| 141 | + |
| 142 | +To review application settings in **App registrations**: |
| 143 | + |
| 144 | +1. Sign in to the [portal](https://portal.azure.com) and navigate to **Microsoft Entra ID** > **Manage** > **App registrations**. |
| 145 | +1. Select **All applications**. |
| 146 | +1. Search for and select the client application created by API Management. |
| 147 | +1. In the left menu, under **Manage**, select **API permissions**. |
| 148 | +1. Confirm that the application has permissions to access the backend product application or applications. |
| 149 | + |
| 150 | + For example, if the client application grants access to the **Starter** product, the application has **Product.Starter.All** permissions to access the **APIMProductApplicationStarter** application. |
| 151 | + |
| 152 | + :::image type="content" source="media/applications/client-api-permissions.png" alt-text="Screenshot of API permissions in the portal."::: |
| 153 | + |
| 154 | + |
| 155 | +## Create token and use with API call |
| 156 | + |
| 157 | +After you enable application-based access for a product and register a client application, a developer or app can generate a token to call the product's APIs. The token must be included in the `Authorization` header of a request. |
| 158 | + |
| 159 | +For example, a developer or app can run the following Azure PowerShell scripts to call the client application to generate a token, and then use the token to call a product API in API Management. |
| 160 | + |
| 161 | +> [!CAUTION] |
| 162 | +> The following scripts are examples for testing purposes only. In production, use a secure method to store and retrieve the client secret. |
| 163 | +
|
| 164 | +### Call client application to generate token |
| 165 | + |
| 166 | + |
| 167 | +```powershell |
| 168 | +# Replace placeholder values with your own values. |
| 169 | +
|
| 170 | +$clientId = "00001111-aaaa-2222-bbbb-3333cccc4444" # Client (application) ID of client application |
| 171 | +$clientSecret = "******" # Retrieve secret of client application in developer portal |
| 172 | +$scopeOfOtherApp = "api://55556666-ffff-7777-aaaa-8888bbbb9999/.default" # Value of Audience in product properties |
| 173 | +$tenantId = "aaaabbbb-0000-cccc-1111-dddd2222eeee" # Directory (tenant) ID in Microsoft Entra ID |
| 174 | +
|
| 175 | +$body = @{ |
| 176 | + grant_type = "client_credentials" |
| 177 | + client_id = $clientId |
| 178 | + client_secret = $clientSecret |
| 179 | + scope = $scopeOfOtherApp |
| 180 | +} |
| 181 | +$response = Invoke-RestMethod -Method Post -Uri "https://login.microsoftonline.com/$tenantId/oauth2/v2.0/token" -ContentType "application/x-www-form-urlencoded" -Body $body |
| 182 | +$token = $response.access_token |
| 183 | +``` |
| 184 | + |
| 185 | +### Call product API using token |
| 186 | + |
| 187 | +The token generated in the previous step is used to call a product API. The token is passed in the **Authorization** header of the request. The API Management instance validates the token and authorizes access to the API. |
| 188 | + |
| 189 | +The following script shows an example call to the echo API. |
| 190 | + |
| 191 | +```powershell |
| 192 | +# Gatewate endpoint to call. Update with URI of API operation you want to call. |
| 193 | +$uri = "https://<gateway-hostname>/echo/resource?param1=sample" |
| 194 | +$headers = @{ |
| 195 | + "Authorization" = "Bearer $token" # $token is the token generated in the previous script. |
| 196 | +} |
| 197 | +$body = @{ |
| 198 | + "hello" = "world" |
| 199 | +} | ConvertTo-Json -Depth 5 |
| 200 | +
|
| 201 | +$getresponse = Invoke-RestMethod -Method Post -Uri $uri -ContentType "application/x-www-form-urlencoded" -Headers $headers -Body $body |
| 202 | +Write-Host "Response:" |
| 203 | +$getresponse | ConvertTo-Json -Depth 5 |
| 204 | +``` |
| 205 | + |
| 206 | +## Related content |
| 207 | + |
| 208 | +* [Create and publish a product](api-management-howto-add-products.md) |
| 209 | +* [Authentication and authorization to APIs in API Management](authentication-authorization-overview.md) |
| 210 | + |
0 commit comments