Calling downstream API as an "App Service" when Azure Function is using Easy Auth

[munkii]

Azure Function v3
Microsoft.Identity.Web

We have an Azure Function that is secured to Azure B2C accounts and that is configured using EasyAuth in the Azure Portal

Until recently that was sufficient but now the Azure Function needs to call one of our App Services that is secured by Azure Ad. The Azure Function would be calling the WebAPI in the context of the function rather than on behalf of the User.

I was planning on initialising MicrosoftIdentityWeb using

 builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
             .AddMicrosoftIdentityWebApi(config, "AzureAd")
             .EnableTokenAcquisitionToCallDownstreamApi()
             .AddInMemoryTokenCaches();

this works great when run on my local machine but EasyAuth does not run locally. Once i deploy this code into Azure the function crumbles. Not only can our clients no longer call the function, the Azure Portal reports errors with the function being unable to talk to it's own configuration.

Now that I look at AddAuthentication call I can see that obviously affects all the client endpoints in the function that will clearly clash with ther EasyAuth config

1. Is there documentation that shows moving an Azure Function away from EasyAuth to just MicrosoftIdentityWeb authentication?
2. Is there a way of me initialising MicrosoftIdentityWeb without adding Authentication for the externally facing endpints of the function but down allow me to get a token for the function to call the WebAPI like this

var accessToken = await this.tokenAcquisition.GetAccessTokenForAppAsync(this.signalApiScope);
this.httpClient.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", accessToken);
this.httpClient.DefaultRequestHeaders.Accept.Add(new MediaTypeWithQualityHeaderValue("application/json"));

[munkii]

I now have this working but would still be intertested in hearing more about replacing EasyAuth with Microsoift Identity Web

I am now just using ConfidentialClientApplicationBuilder to get the token and I am no longer trying to initialise MS Ideneoty Web in Startup

private async Task PrepareAuthenticatedClient()
{
    string azureAdClientId = Environment.GetEnvironmentVariable("AzureAd__ClientId", EnvironmentVariableTarget.Process);
    string azureAdInstance = Environment.GetEnvironmentVariable("AzureAd__Instance", EnvironmentVariableTarget.Process);
    string azureAdTenantId = Environment.GetEnvironmentVariable("AzureAd__TenantId", EnvironmentVariableTarget.Process);
    string azureAdClientSecret = Environment.GetEnvironmentVariable("AzureAd__ClientSecret", EnvironmentVariableTarget.Process);

    if (azureAdClientSecret == null)
    {
        // I found issues where the value AzureAd__ClientSecret from usersecrets.json that is in local dev was not appearing in Environment variables
        // so I had to get it from config
        azureAdClientSecret = this.clientSecretFromConfig;
    }

    var app = ConfidentialClientApplicationBuilder.Create(azureAdClientId)
                                        .WithClientSecret(azureAdClientSecret)
                                        .WithAuthority(new Uri($"{azureAdInstance}{azureAdTenantId}/"))
                                        .Build();

    var acquireTokenBuilder = app.AcquireTokenForClient(new string[1] { this.signalApiScope });
    var accessToken = await acquireTokenBuilder.ExecuteAsync();

    this.httpClient.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", accessToken.AccessToken);
    this.httpClient.DefaultRequestHeaders.Accept.Add(new MediaTypeWithQualityHeaderValue("application/json"));
}