Securing ASP.NET Core APIs with Microsoft Entra ID Authentication

Introduction

APIs often expose sensitive business data such as customer information, financial records, and internal operations. If these APIs are not properly secured, unauthorized users or applications may gain access to confidential information.

One of the most reliable ways to secure ASP.NET Core APIs is by using Microsoft Entra ID (formerly Azure Active Directory). It provides a centralized identity platform that authenticates users and applications before allowing access to protected resources.

Instead of managing usernames, passwords, and authentication logic within your application, you can rely on Microsoft Entra ID to handle identity management while your API focuses on authorization and business logic.

In this article, you'll learn how Microsoft Entra ID authentication works with ASP.NET Core APIs, how to configure it, and the best practices for securing enterprise applications.

What Is Microsoft Entra ID?

Microsoft Entra ID is Microsoft's cloud-based identity and access management service.

It allows organizations to:

Authenticate users
Authenticate applications
Manage user identities
Enable Single Sign-On (SSO)
Enforce Multi-Factor Authentication (MFA)
Apply Conditional Access policies
Secure cloud and on-premises applications

Instead of storing user credentials in your application, authentication is handled by Microsoft Entra ID.

How Authentication Works

A typical authentication flow looks like this:

A user signs in through Microsoft Entra ID.
Entra ID verifies the user's identity.
A JWT access token is issued.
The client includes the token in API requests.
ASP.NET Core validates the token.
If the token is valid, the request is processed.

This approach eliminates the need for custom login systems and improves overall security.

Register Your API

Before your API can trust Microsoft Entra ID, it must be registered in the Microsoft Entra admin center.

During registration, you'll receive important values such as:

Application (Client) ID
Directory (Tenant) ID
Authority URL

These values are used by your ASP.NET Core application to validate incoming access tokens.

Configure Authentication

Install the required NuGet package:

dotnet add package Microsoft.Identity.Web

Next, configure authentication in your application.

builder.Services
    .AddAuthentication("Bearer")
    .AddMicrosoftIdentityWebApi(builder.Configuration);

This enables JWT Bearer authentication using Microsoft Entra ID.

Configure Application Settings

Store your authentication settings in appsettings.json.

{
  "AzureAd": {
    "Instance": "https://login.microsoftonline.com/",
    "TenantId": "your-tenant-id",
    "ClientId": "your-client-id"
  }
}

Keeping configuration outside your source code makes the application easier to maintain and more secure.

For production environments, consider using a secure secret management solution instead of storing sensitive values directly in configuration files.

Protect API Endpoints

Once authentication is configured, protecting an endpoint is straightforward.

app.MapGet("/employees", () =>
{
    return Results.Ok(EmployeeRepository.GetAll());
})
.RequireAuthorization();

Only authenticated users with a valid access token can access this endpoint.

Unauthenticated requests receive an appropriate HTTP status code indicating that authentication is required.

Implement Role-Based Authorization

Authentication confirms a user's identity, while authorization determines what they are allowed to do.

For example, only administrators should be able to create new users.

app.MapPost("/users", () =>
{
    return Results.Ok();
})
.RequireAuthorization("Admin");

This ensures that authenticated users cannot automatically access every API operation.

Calling a Protected API

Clients send the access token using the Authorization header.

GET /api/products HTTP/1.1
Authorization: Bearer eyJhbGciOi...

ASP.NET Core validates the token before executing the endpoint.

If the token is expired, invalid, or missing, access is denied.

Common Security Features

Microsoft Entra ID includes several built-in security capabilities that strengthen API protection.

Some of these features include:

Multi-Factor Authentication (MFA)
Single Sign-On (SSO)
Conditional Access
Token validation
Identity protection
Managed identities
Centralized user management

These features help reduce security risks while simplifying authentication management.

Common Mistakes to Avoid

When securing APIs, avoid these common mistakes:

Creating custom authentication logic when a trusted identity provider is available.
Storing secrets directly in source code.
Allowing anonymous access to sensitive endpoints.
Skipping token validation.
Granting excessive permissions to users or applications.
Failing to rotate secrets and certificates when required.

Following secure development practices reduces the risk of unauthorized access.

Best Practices

When securing ASP.NET Core APIs with Microsoft Entra ID, keep these recommendations in mind:

Use Microsoft Entra ID as the central identity provider.
Protect all sensitive endpoints with authentication and authorization.
Implement role-based or policy-based authorization where appropriate.
Store configuration and secrets securely.
Always use HTTPS for API communication.
Validate every access token before processing requests.
Enable logging and monitoring to detect suspicious activity.
Regularly review application permissions and access policies.

Conclusion

Microsoft Entra ID provides a secure and scalable way to protect ASP.NET Core APIs without building a custom authentication system. By handling user authentication, token issuance, and identity management, it allows developers to focus on building business functionality while benefiting from enterprise-grade security features.

When combined with proper authorization, secure configuration, and API best practices, Microsoft Entra ID helps create applications that are easier to manage, more secure, and ready for modern cloud and enterprise environments.