Azure Function custom connector with Entra ID sign-in, step by step

Protect the Function with Entra ID

1. In the Azure portal, open the Function app and select Settings > Authentication.
2. Select Add identity provider, choose Microsoft, and let it create a new app registration. This is the API app.
3. Set Restrict access to Require authentication, and Unauthenticated requests to HTTP 401 Unauthorized, the choice for APIs.
4. Open the new app registration and select Expose an API. Check that it has an Application ID URI, normally api:// followed by its client ID, and at least one scope. Add them if they're missing. Copy the URI.
5. Back on the Function app's Authentication page, edit the Microsoft provider and check that Allowed token audiences includes that Application ID URI. A token for any other audience is rejected.

About the function key: with Require authentication on, App Service refuses calls without a valid token before they reach your code. If your HTTP trigger also uses the Function authorization level, the connector must send the key as well. Either add the key to the connector as a second check, or set the trigger to Anonymous and rely on the sign-in; never do the second while authentication is optional.

Register the connector app

1. In the Microsoft Entra admin center, open App registrations > New registration. Name it after the connector and keep it single-tenant unless people from other tenants will use it.
2. Under Certificates & secrets, create a client secret. Copy the Value straight away, and note when it expires.
3. Under API permissions, select Add a permission > My APIs, choose the Function's app, and tick its scope as a Delegated permission.
4. If your tenant requires it, select Grant admin consent. Otherwise each person sees a consent prompt the first time they connect.

Create the connector

1. In Power Apps or Power Automate, open Custom connectors and create one from blank, or import an OpenAPI file if your Function publishes one.
2. On General, set Host to the Function app's host name (<your-app>.azurewebsites.net) and Base URL to /api.
3. On Definition, add an action for each function you'll call, with its method, path and parameters. A sample request and response make the action's inputs and outputs readable in the designer.

Set the connector's security

On the Security tab:

Select Create connector. A Redirect URL then appears on this tab. Every connector has its own, of the form https://global.consent.azure-apim.net/redirect/<connector-id>. Copy it, and in the connector app open Authentication > Add a platform > Web, paste it, and save.

Test it

On the connector's Test tab, create a new connection, sign in, and run an action. A 200 with your function's response means every part matches. In the function, App Service passes the caller's identity in request headers such as X-MS-CLIENT-PRINCIPAL-NAME, so you can log or check who called without validating the token yourself.