Configure OAuth 2.0 in Azure API Management (APIM)

Introduction

After creating an Azure AD App Registration and generating tokens, the next step is configuring OAuth 2.0 authorization in Azure API Management (APIM).

This allows APIM to validate JWT access tokens before forwarding requests to backend services like Azure Functions.

What Does OAuth 2.0 Configuration in APIM Do?

• Validates Azure AD-issued access tokens
• Blocks unauthorized requests at the gateway
• Removes authentication logic from backend code
• Centralizes security policies

Prerequisites

• Azure API Management instance
• Azure AD App Registration completed
• OAuth2 token working in Postman

Step 1 – Open OAuth 2.0 Settings in APIM

1. Azure Portal → API Management
2. Select your APIM instance
3. Left menu → OAuth 2.0 + OpenID Connect
4. Click + Add

Step 2 – Configure Authorization Server

• Name: AzureAD-OAuth
• Authorization grant type: Client credentials
• Token endpoint URL:
  https://login.microsoftonline.com/TENANT-ID/oauth2/v2.0/token
• Client ID: Azure AD App Client ID
• Client Secret: Azure AD App Client Secret
• Scope:
  api://CLIENT-ID/access_as_user

Step 3 – Save and Test Authorization Server

1. Click Create
2. Use the Test option to request a token
3. Confirm access token is returned

Step 4 – Apply JWT Validation Policy

<inbound>
    <base />

    <validate-jwt header-name="Authorization"
                  failed-validation-httpcode="401"
                  failed-validation-error-message="Unauthorized">

        <openid-config 
          url="https://login.microsoftonline.com/TENANT-ID/v2.0/.well-known/openid-configuration" />

        <required-audiences>
            <audience>api://CLIENT-ID</audience>
        </required-audiences>

        <required-scopes>
            <scope>access_as_user</scope>
        </required-scopes>

    </validate-jwt>
</inbound>

Azure API Management (APIM) Policies

Azure API Management (APIM) policies are a collection of statements that are executed sequentially on the request or response of an API. These policies help you control API behavior, enforce security, improve performance, and handle errors without changing the backend code.

Types of APIM Policies

• Inbound Policies: Execute before the request reaches the backend. Examples include CORS, rate limiting, JWT validation, and header manipulation.
• Backend Policies: Control how APIM communicates with the backend API, such as retry policies and request forwarding with timeouts.
• Outbound Policies: Execute after the backend response and before sending data to the client, including caching, response transformation, and header modifications.
• On-Error Policies: Handle errors gracefully and customize the response when the backend or any policy fails.

Benefits of Using APIM Policies

• Centralized security enforcement
• Improved API performance via caching and rate limiting
• Reduced backend code complexity
• Customizable responses and error handling

How the Request Flow Works

1. Client requests token from Azure AD
2. Client sends token to APIM
3. APIM validates token
4. APIM forwards request to Azure Function

How OAuth Client Secrets Are Stored Securely

By default, Azure API Management securely stores OAuth client secrets internally. This means the client secret is encrypted at rest by Azure and is not exposed to API consumers, logs, or frontend applications.

The secret is only used by APIM at runtime when requesting tokens from Azure Active Directory. Backend services never receive or handle this secret.

For higher security or enterprise compliance, client secrets can also be stored in Azure Key Vault and referenced securely from APIM using managed identities. This approach allows centralized secret rotation and access control.

What You Can Store Securely in APIM or Azure Key Vault

When configuring OAuth 2.0 or other API integrations, you often need to store secrets, keys, or credentials securely. Here’s a breakdown:

1. APIM Internal Storage

• OAuth Client Secrets: Used by APIM to request tokens from Azure AD.
• Subscription Keys: Keys that APIM generates for your APIs.
• Certificates: For backend service authentication (optional).

These are encrypted at rest and never exposed outside APIM. Learn more.

2. Azure Key Vault (Recommended for Enterprise)

• OAuth Client Secrets: Centralized storage with automatic rotation.
• Connection Strings: Databases, storage accounts, or third-party services.
• API Keys: Any external service API keys.
• Certificates: SSL/TLS certificates or client auth certificates.
• Other Secrets: Passwords, tokens, or sensitive configuration values.

Access Key Vault securely from APIM using Managed Identity. Learn how to store secrets in Azure Key Vault.

Quick Comparison

Next Step

• Azure APIM Versioning Strategies