Azure App Service is able to use Managed Identity(no app roles) to call another AAD protected App service, Why?

Question

Structure Step Up

App service A, with app service plan A(Free Tier), with System Assigned Identity On
App service B, with app service plan B(Free Tier), with AAD authentication and authorization, with service principle B

That's it, no more further setups, no app roles, no token audience.

Then I made a very simple console app using .Net 5.

        var azureServiceTokenProvider = new AzureServiceTokenProvider();

        var token = azureServiceTokenProvider.GetAccessTokenAsync("SPN B's client Id", "Tenant Id").GetAwaiter().GetResult();

        Console.WriteLine(token);

        using (var hc = new HttpClient())
        {
            hc.DefaultRequestHeaders.Authorization = new System.Net.Http.Headers.AuthenticationHeaderValue("Bearer", token);

            var res = hc.GetAsync("App service A url").GetAwaiter().GetResult();

            var body = res.Content.ReadAsStringAsync().GetAwaiter().GetResult();

            Console.WriteLine(body);
        }

Then I dropped this console app to App service A's Kudu console and run it. Surprisingly it was able to use the managed identity token to access app service B.

I am very confused, the managed identity should not have any accesses. The returned JWT token:

{ "aud": "SPN B's client id", "iss": "issuer", "iat": 1614463676, "nbf": 1614463676, "exp": 1614550376, "aio": "E2ZgYHAIulMkupMv5ku6dYrERh0LAA==", "appid": "Managed identity client id", "appidacr": "2", "idp": "issuer", "oid": "Managed identity object id", "rh": "0.ASgA43WCTWxU70i_QFayzgGduttb1iTw-FBIn9cvBo6st-IoAAA.", "sub": "Managed identity object id", "tid": "tenant id", "uti": "--aa0ubSrEqW4yeOzeYBAA", "ver": "1.0" }

Could someone please help me to understand this situation. Is it because of the free tier app service plan or other default setups?

Thank you a lot in advance!

Joy Wang-MSFT Joy Wang-MSFT · Accepted Answer · 2021-03-01T02:20:34

It's a normal case.

If you configure the AAD auth for the app service/azure function with the express settings like this, actually it will create an App Registration whose Supported account types is My organization only, all the users in this tenant(the app service B located) can login this app, and all the service principals in this tenant(Managed identity is essentially a service principal) can get the access token to access the app service.

If you want to limit this, the app role you mentioned is the option, set User assignment required to Yes for the service principal of the app service B, then just the users/service principals with the roles can access the app, a similar issue here.

Azure App Service is able to use Managed Identity(no app roles) to call another AAD protected App service, Why?

1 Answers