? Using Azure Entra ID
? Registering the Blazor app
? Configuring certificate-based authentication
? Using MSAL
? Calling secured APIs
? Best practices for production

I’ve included both Blazor Server and Blazor WebAssembly flows where applicable.

1. Understanding the Authentication Flow

Azure Entra ID supports two authentications:

A) User Authentication (OpenID Connect)

When the app signs in users with Azure AD.

B) App Authentication (Client Credential Flow using Certificate)

App authenticates itself using a certificate.

You can combine both:

• Users sign in using Azure AD

• App (Blazor) calls downstream APIs using certificate-based client credentials

This is the most common enterprise setup.

2. Azure Setup (Required)

Step 1: Register Two Apps

You need:

(1) Blazor App Registration

For user login.
Redirect URIs:

https://localhost:7177/signin-oidc

Also add logout:

https://localhost:7177/signout-callback-oidc

(2) API or Protected Resource Registration

Or even Microsoft Graph.

This app will have:

• Client ID

• Tenant ID

• Expose API Scopes

• Certificate-based credentials (Upload Certificate)

3. Upload Certificate to Entra ID

Go to:

Azure Portal ? App Registrations ? (API App) ? Certificates & Secrets ? Upload Certificate

• Upload .cer (public certificate)

• Private .pfx is stored only in your Blazor app (never upload).

4. Configure Blazor App to Use Certificate Authentication

For Blazor Server, use Microsoft.Identity.Web.

Install:

dotnet add package Microsoft.Identity.Web
dotnet add package Microsoft.Identity.Web.UI

5. Configure appsettings.json

"AzureAd": {
  "Instance": "https://login.microsoftonline.com/",
  "Domain": "yourcompany.com",
  "TenantId": "xxxx-xxxx-xxxx-xxxx",
  "ClientId": "Blazor-App-Client-ID",
  "CallbackPath": "/signin-oidc"
},
"AzureAdClientCert": {
  "ClientId": "API-Client-ID",
  "TenantId": "xxxx-xxxx-xxxx-xxxx",
  "CertificateThumbprint": "YOUR_CERT_THUMBPRINT",
  "Scopes": "api://API-APP-ID/.default"
}

6. Register Authentication in Program.cs (Blazor Server)

var builder = WebApplication.CreateBuilder(args);

builder.Services.AddAuthentication(OpenIdConnectDefaults.AuthenticationScheme)
    .AddMicrosoftIdentityWebApp(builder.Configuration.GetSection("AzureAd"));

builder.Services.AddControllersWithViews()
    .AddMicrosoftIdentityUI();
builder.Services.AddRazorPages();


// Load certificate from store
X509Certificate2 clientCert = LoadCertificateFromStore(
    builder.Configuration["AzureAdClientCert:CertificateThumbprint"]
);

// MSAL ConfidentialClient using certificate
builder.Services.AddSingleton(provider =>
{
    return ConfidentialClientApplicationBuilder
        .Create(builder.Configuration["AzureAdClientCert:ClientId"])
        .WithCertificate(clientCert)
        .WithTenantId(builder.Configuration["AzureAdClientCert:TenantId"])
        .Build();
});

// Token service
builder.Services.AddSingleton();

var app = builder.Build();

app.UseAuthentication();
app.UseAuthorization();

app.MapRazorPages();
app.MapControllers();
app.MapBlazorHub();
app.MapFallbackToPage("/_Host");

app.Run();

7. Certificate Loader Utility

private static X509Certificate2 LoadCertificateFromStore(string thumbprint)
{
    using var store = new X509Store(StoreLocation.CurrentUser);
    store.Open(OpenFlags.ReadOnly);

    return store.Certificates
        .Find(X509FindType.FindByThumbprint, thumbprint, validOnly: false)
        .OfType()
        .FirstOrDefault()
        ?? throw new Exception("Certificate not found");
}

8. Token Acquisition Service (using MSAL)

public class TokenAcquisitionService
{
    private readonly IConfidentialClientApplication _client;
    private readonly IConfiguration _config;

    public TokenAcquisitionService(IConfidentialClientApplication client, IConfiguration config)
    {
        _client = client;
        _config = config;
    }

    public async Task GetAccessTokenAsync()
    {
        var scopes = _config["AzureAdClientCert:Scopes"].Split(' ');
        
        var result = await _client
            .AcquireTokenForClient(scopes)
            .ExecuteAsync();

        return result.AccessToken;
    }
}

9. Calling API from Blazor using Certificate-based Token

public class ApiClient
{
    private readonly TokenAcquisitionService _tokenService;
    private readonly HttpClient _http;

    public ApiClient(TokenAcquisitionService tokenService, IHttpClientFactory httpFactory)
    {
        _tokenService = tokenService;
        _http = httpFactory.CreateClient("Api");
    }

    public async Task GetSecuredDataAsync()
    {
        string token = await _tokenService.GetAccessTokenAsync();

        _http.DefaultRequestHeaders.Authorization =
            new AuthenticationHeaderValue("Bearer", token);

        return await _http.GetStringAsync("/secured-endpoint");
    }
}

10. For Blazor WebAssembly (WASM)

WASM cannot securely store a certificate ? you must use:

? Backend API / BFF (Backend-for-Frontend pattern)
? Or Azure API Management

The certificate-based authentication must happen on server side, not in browser.

WASM can only do user authentication, not certificate authentication.

11. End-to-End Flow

User Login Flow (OIDC)

User ? Blazor App ? Azure AD ? ID Token ? Authenticated in UI

App-to-App Flow (Certificate)

Blazor App ? Certificate ? Azure AD Token Endpoint
? Access Token ? Call Downstream API

12. Recommended Architecture

[User]
   ? OIDC
[Blazor App] (Server)
   ? Certificate-based Client Credential
[Azure Entra ID]
   ? Access Token
[Protected API]

13. Security Best Practices

? Use PFX with password
? Store certificate in Azure Key Vault (Recommended)
? Rotate certificates every 6–12 months
? Never store cert in GitHub
? Use .default scope for client credentials