This post has been republished via RSS; it originally appeared at: New blog articles in Microsoft Community Hub.
Since, well, the beginning of Azure API Management, you've been able to validate that the Json Web Token (JWT) coming into your Azure API Management service is valid before passing it onto the backend service. The validate-jwt policy is one of the most used policies within Azure API Management, will happily ensure your client applications are using the right client IDs, and have the right audiences and claims. Meanwhile, Azure Active Directory (AAD) is a mainstay of enterprise APIs, providing authentication and authorization controls for a wide variety of APIs from M365 APIs to custom-built APIs. It's generally the center piece of your enterprise API security infrastructure.
Wouldn't it be wonderful if they worked better together.
Introducing validate-azure-ad-token policy
This week we introduced a new policy for working with AAD in Azure API Management - the validate-azure-ad-token policy. It's a direct replacement for validate-jwt that you can use when you are targeting AAD.
Here is the general form of the policy:
This version ensures that the audience is the API Management host and that the optional claim ctry (the country) is provided and has a specific value. This is actually a more complex example than is necessary. You can get minimal validation by just specifying the `tenant-id` and the client application-id values you expect:
Since we know that Azure API Management works wonderfully with AAD, it makes sense that we make it easier to configure and easier to take advantage of value-added services provided by the AAD service. Features like continuous access evaluation improve your security posture by removing the lag between when a token is issued and when it can be revoked. This allows you to issue tokens for longer periods without a loss in security which, in turn, improves the performance of the client application. You can expect to see these features being added to our new validate-azure-ad-token policy in the future.
We're really excited by this new policy because it provides an anchor for AAD specific functionality in the future. It's easier to configure and sets you up for adopting future security enhancements at the gateway. This will allow your API service to adopt the security enhancements provided by AAD without any code changes.
The validate-azure-ad-token policy is recommended for protecting your API with Azure Active Directory identities and Azure API Management.