Entra ID / Easy Auth Recipe — REFERENCE ONLY

Adds authentication and authorization to an App Service base template using Microsoft Entra ID.

Overview

This recipe configures authentication for App Service apps using either Easy Auth (built-in authentication) or MSAL SDK-based authentication. Easy Auth requires zero code changes; MSAL gives full control.

Integration Type

Option A: Easy Auth (Recommended for most apps)

Zero-code authentication built into App Service. Handles login, token management, and session cookies.

Bicep Configuration

💡 Call mcp_bicep_get_az_resource_type_schema with resource type Microsoft.Web/sites/config to validate properties before generating this resource.

resource authSettings 'Microsoft.Web/sites/config@2023-12-01' = {
  parent: webApp
  name: 'authsettingsV2'
  properties: {
    globalValidation: {
      requireAuthentication: true
      unauthenticatedClientAction: 'RedirectToLoginPage'
    }
    identityProviders: {
      azureActiveDirectory: {
        enabled: true
        registration: {
          openIdIssuer: 'https://login.microsoftonline.com/${tenant().tenantId}/v2.0'
          clientId: appRegistration.properties.appId
        }
        validation: {
          defaultAuthorizationPolicy: {
            allowedApplications: []
          }
        }
      }
    }
    login: {
      tokenStore: {
        enabled: true
      }
    }
  }
}

App Registration

💡 Call mcp_bicep_get_az_resource_type_schema with resource type Microsoft.Graph/applications to validate properties before generating this resource. The microsoftGraphV1_0 extension is required — declare it at the top of the Bicep file.

extension microsoftGraphV1_0

resource appRegistration 'Microsoft.Graph/[email protected]' = {
  displayName: '${name}-app'
  web: {
    redirectUris: [
      'https://${webApp.properties.defaultHostName}/.auth/login/aad/callback'
    ]
  }
}

Option B: MSAL SDK (Full control)

Use when you need custom token validation, API-only auth, or multi-tenant support.

App Settings

References

• Easy Auth overview
• Microsoft Identity Web
• Configure Entra ID auth