Account Security Problems

Secure SPFx Web Parts Calling Azure Functions with Microsoft Entra ID

Partner Editor Sep 29, 2026 869 views

Question details

The user requires a secure architecture methodology to facilitate communication between a SharePoint Framework (SPFx) web part and an Azure Function, leveraging Microsoft Entra ID and managed identities.

Secure SPFx Web Parts Calling Azure Functions with Microsoft Entra ID

Product: Microsoft Azure / SPFx
Device & OS: not provided
Scenario: Implementing a secure authentication pipeline for a frontend SPFx web part that needs to call an Azure Function, which in turn interacts with downstream APIs and Azure resources.
Observed behavior: Establishing the correct configuration for OAuth 2.0 On-Behalf-Of (OBO) flow and managed identities to ensure secure access without exposing client secrets.

Before you start

Ensure you have active administrative privileges in your Microsoft Entra ID (formerly Azure AD) tenant to register applications, configure API permissions, and manage Azure resources.

Solution 1Recommended

Implement Microsoft Entra ID Authentication and OBO Flow

Secure the Azure Function by configuring Microsoft Entra ID, setting up the SPFx web part to request tokens, and utilizing the On-Behalf-Of flow for downstream API access.

To achieve a highly secure architecture, client secrets must not be stored in the frontend or hardcoded in the backend. Instead, leverage Microsoft Entra ID for robust identity management and use managed identities for Azure-to-Azure service authentication.

Secure the Azure Function

Register your Azure Function in Microsoft Entra ID. Expose an API by navigating to 'Expose an API' in your App Registration and defining a custom scope that the SPFx web part will request.

Configure the SPFx Web Part

In your SPFx solution, configure the web part to request an access token for the Azure Function's newly exposed API scope using the AadHttpClient available in the SPFx framework.

Implement the On-Behalf-Of (OBO) Flow

If your Azure Function needs to call downstream protected APIs (such as Microsoft Graph), configure the backend code to use the OAuth 2.0 On-Behalf-Of flow. This exchanges the incoming user token for a downstream token on behalf of the signed-in user.

Enable Managed Identities

Navigate to the Identity blade of your Azure Function in the Azure Portal. Enable either a system-assigned or user-assigned managed identity. This allows the function to securely access other Azure resources (like SQL or Key Vault) without requiring stored credentials.

Apply Least-Privilege and Store Secrets

Assign only the minimum required permissions to your managed identity. If your application relies on third-party API keys, store these remaining secrets securely in Azure Key Vault and restrict network access where appropriate.

Monitoring Recommended: Regularly monitor your sign-in logs and application logs within Azure Monitor to ensure your authentication flow remains secure and to swiftly detect any unauthorized access attempts.

Free Microsoft Office alternative

Need a tool for your architectural documentation? Try WPS Office

While architecting secure SPFx and Azure deployments, you often need to draft detailed technical specifications, security protocols, and diagrams. WPS Office provides a free, lightweight, and highly compatible alternative to Microsoft Office for writing and managing all your project documentation.

1. Download the Installer: Navigate to the official WPS Office website and download the free installation package for your operating system.
2. Install WPS Office: Run the setup file and follow the streamlined installation wizard to deploy the suite on your machine.
3. Open Your Documentation: Launch WPS Writer, Spreadsheet, or Presentation to immediately open and edit your existing Microsoft Office files without formatting loss.

Highly compatible with Microsoft Word, Excel, and PowerPoint formats (.docx, .xlsx, .pptx) for sharing technical specs.Lightweight architecture ensures it consumes minimal system resources while you run demanding IDEs and local servers.Built-in PDF toolkit makes it simple to export and securely share architectural documentation with stakeholders.Familiar ribbon user interface guarantees a seamless migration with zero learning curve.

microsoft office alternative - wps office

Frequently Asked Questions

What is the purpose of the OAuth 2.0 On-Behalf-Of (OBO) flow in this scenario?

The OBO flow allows the middle-tier service (the Azure Function) to exchange the access token it receives from the client (the SPFx web part) for a new token. This new token is then used to call downstream APIs (like Microsoft Graph) while maintaining the original user's identity and permissions.

Why should I use managed identities instead of standard client secrets?

Managed identities are automatically managed by Microsoft Entra ID and eliminate the need for developers to handle, rotate, or store credentials in code or configuration files. This significantly reduces the risk of credential leakage when your Azure Function connects to other Azure resources.

Can I securely store API keys directly within the SPFx web part?

No. SPFx web parts execute entirely within the user's web browser, meaning any secrets stored in the frontend code are exposed to the client. You should always proxy calls requiring secrets through a backend service like an Azure Function, and keep the actual secrets secured in Azure Key Vault.

Microsoft Office Security Issues