Secure Azure Function With Azure AD

Overview

 

Azure functions are helpful to perform processing outside of SharePoint. In the previous article, SharePoint Framework - Call Azure Function, we explored an option to create Azure functions with anonymous access. In real scenarios, it is not recommended to have Azure functions with anonymous access.

 

In this article, we will explore how to secure Azure function with Azure AD.

 

Azure AD App Registration

1. Open Azure Portal https://portal.azure.com
2. From left menu, click “Azure Active Directory”
3. Click “App registrations”
4. Click “New application registration”
   
   
   
   
5. Specify any name for app registration
6. Select “Application type” as “Web app / API”
7. Specify “Sign-on URL” as url of the Azure function we will be creating in next step
   
   
   
   
8. Click Create

Get the App ID URI

1. Click “Settings”
2. Click “Properties”
3. Note down “App ID URI” for future reference
   
   

App registration permissions

 

By default, app registration have “Sign in and read user profile” permission. To modify the permissions, follow below steps,

1. Click Settings
2. Click “Required permissions” under “API ACCESS”
3. Click “Add”
   
   
   
   
4. Add or update permissions as needed.

Grant permissions to App registration

 

As an administrator, grant permissions to the App registration for all the users.

1. Click Settings
2. Click “Required permissions” under “API ACCESS”
3. Click “Grant permissions”
4. Click “Yes”

Azure Function

 

Azure functions are serverless computing. It is an event driven, compute on demand experience. Follow the below steps to create an Azure function,

1. Open Azure Portal https://portal.azure.com
2. Click Create Resource
3. Under Compute, select Function App
   
   
   
   
4. Fill in the information to create the Function App
   
   
   
   
5. Click Create
6. Once the Azure function is ready, click “Platform features” tab
7. Under Networking, click “Authentication / Authorization”
   
   
   
   
8. In the option “App Service Authentication”, select “ON”
9. For "Action to take when request is not authenticated" option, select “Log in with Azure Active Directory”
10. Under “Authentication Providers”, select “Azure Active Directory”
    
    
     
    
    
11. Select “Management mode” as “Advanced”
12. In the “Client ID” textbox, paste the Application ID we created in earlier step - “Azure AD App Registration”
13. In “Allowed Token Audiences”, copy App ID URI we created in earlier step
    
    
    
    
14. Click OK

Enable CORS on Azure Function

 

The Azure functions are hosted in MS Azure and they run in a different domain than our SharePoint site where our SharePoint Framework (SPFx) web part is hosted. By default cross domain calls are not allowed from SharePoint. To overcome this we will have to enable CORS (Cross-Origin Resource Sharing) in Azure function.

 

Follow the below steps to enable CORS on Azure function,

1. Click Platform features
2. Under API, click CORS
   
   
   
   
3. Specify the Office 365 tenant domain url and SharePoint local workbench url
   
   
   
   
4. Click Save

Implement Azure Function

1. Open Visual Studio (2015 or 2017)
2. If you are using Visual Studio 2015, install “Visual Studio Tools for Azure Functions” from here 
3. Click “New Project”
4. Under Visual C#, select Cloud > Azure Functions
5. Name the project (e.g. SecureFunctionApp)
   
   
   
   
6. Click OK
7. Right click the project name. Select Add > New Item…
8. Add Azure function named "UserInformation"
   
   
   
   
9. Click Add
10. Select Http trigger
11. For “Access rights” select “Anonymous”. We are using Azure AD in the Function app to secure it.
    
    
    
    
12. Click OK
13. Use the below code in Function app
    

    using Microsoft.Azure.WebJobs;
    using Microsoft.Azure.WebJobs.Extensions.Http;
    using Microsoft.Azure.WebJobs.Host;
    using System.Collections.Generic;
    using System.Net;
    using System.Net.Http;
    using System.Net.Http.Formatting;
    using System.Security.Claims;
    using System.Threading.Tasks;
    
    namespace SecureFunctionApp
    {
        public static class UserInformation
        {
            [FunctionName("UserInformation")]
            public static async Task<HttpResponseMessage> Run([HttpTrigger(AuthorizationLevel.Anonymous, "get", "post", Route = null)]HttpRequestMessage req, TraceWriter log)
            {
                log.Info("C# HTTP trigger function processed a request.");
    
                var result = new Dictionary<string, string>();
    
                // Get current user claims
                foreach (Claim claim in ClaimsPrincipal.Current.Claims)
                {
                    result.Add(claim.Type, claim.Value);
                }
    
                return req.CreateResponse(HttpStatusCode.OK, result, JsonMediaTypeFormatter.DefaultMediaType);
            }
        }
    }

14. Right click the project name. Select Publish…
15. Click “Select existing”
    
    
    
    
16. Click Publish
17. Select the earlier created Function app
    
    
    
    
18. Click OK to publish the function to the Azure function app.

Summary

 

In the production environment, it is always recommended to secure the Azure function. Azure functions can be easily secured with Azure AD by associating it with Azure AD App Registration.