Search code examples
azureazure-active-directoryazure-web-app-serviceazure-logic-apps

Azure Logic App HTTP Request Authentication Scope

We have an API hosted in Azure as an Azure Web App that we need to trigger via http on a schedule.

Our API requires a valid Azure AD Access Token be sent with each request.

Azure Logic Apps gives us the option to authenticate our request with Azure AD. However, we do not see the option of including scope in the request. If we send a request without specified scope or role, we get the following error:

System.UnauthorizedAccessException: IDW10201: Neither scope or roles claim was found in the bearer token.

enter image description here

How can we authenticate an http request from an Azure Logic App when scope/role is required in the access token by the API?

Solution

  • Thanks to @Skin for the suggestion!

    Here is what worked for future visitors to this question:

    Navigate to your Logic App in the Azure Portal > Select "Logic App Code View" > Add the following to "authentication":

    enter image description here

    • audience: "api://<your api's clientId>"
    • clientId: "<your logic app's clientId>"
    • scope: "api://<your api's clientId>/.default" (this piece is not available in the interface)
    • secret: "the secret you generated for your logic app in your aad app registration"
    • tenant: "your tenant id"