Receives tokens issued by Microsoft Entra, validates them and decides what callers may do based on their roles and scp claims. A web app making the calls acts purely as a client.
Read more: Microsoft Learn
In the Ultra Transcenders books
Each book explains Web API in context, with comparison tables and the common traps.
Terms in this definition
- Microsoft Entra
The umbrella brand covering Microsoft's identity and network access portfolio. Internet Access, Private Access, External ID and ID Governance all belong to it, built on top of the core directory service, Entra ID.
- SCP
Created in Active Directory by Microsoft Entra Connect, this object tells domain-joined machines which tenant to register with during hybrid join.
- App protection policy
A set of Intune rules on managed apps that safeguards organisational data, for example by demanding a PIN or preventing copy-paste and save-as into personal apps. It works whether or not the device is enrolled.
Related terms
- API
Short for application programming interface: a contract that client code calls programmatically, for example a web API secured with tokens or the Files, Images or Responses APIs.
- Application ID URI
Set on the Expose an API page, defaulting to
api://<application-client-id>, this globally unique value names a web API. Prefixing it to a scope name gives the complete scope string. - Confidential client
Because it runs on a server (a daemon, web API or web app, say) it can safely hold a secret, and so it authenticates as itself with a federated credential, certificate or client secret, something no public client can do.