Azure Active Directory B2C and Azure Functions

Hello everyone,

In the light of my recent post about B2C and ASP.NET Core web APIs, I thought I'd shed some light on how to make Azure Functions work with B2C, because it may not be immediately obvious from the portal's interface. Actually, all the information is already in this article, and it still applies:

Setting up B2C authentication for your Azure Functions App is actually really easy:

  1. Create your Azure Functions App and write down the URL

    1. E.g. (make sure to make it a HTTPS URL)


  2. Configure your application in Azure Active Directory B2C:

    1. Write down the Application ID
    2. Add a reply URL for your Functions App, adding the suffix /.auth/login/aad/callback. E.g.


    The configuration should look something like this:


  3. Get the Metadata Endpoint URL for your Sign-in policy

    1. If you open the details of your sign-in policy, you'll find it right at the top. E.g.:


  4. In your Functions App, on the bottom left select "Function app settings" and go to "Configure authentication":


  5. Turn on authentication and select Azure Active Directory:


  6. Select the advanced settings and enter the following values:

    1. Client ID: The Application ID which you copied in step 2. a.
    2. Issuer Url: The Metadata Endpoint URL from step 3.


  7. Save your settings and you're done!


Once the changes have taken effect, if you try to test your Azure Function without an Authorization header, you'll get the following error – as expected:


However, with a valid bearer token, you're up and running again:


I hope this made your life a little bit easier.

Helge Mahrt

Comments (15)

Cancel reply

  1. Jarrod says:


    This (and the referenced post from last year too) is helpful indeed. However, neither post actually shows invoking the FunctionApp/Function via a simple B2C policy. I’ve been trying to get mine to work, but to no avail. Do you all have more thorough examples in posts or on GitHub that work? The /.auth/login/aad/callback doesn’t seem to be working in the current version of Functions, from my experience anyhow.

    1. Helge Mahrt says:

      Hello Jarrod,
      Once you set this up, the functions app will behave like any other web api that’s been secured with B2C. You’ll need to provide an Authorization header with a valid access token during the HTTP calls. You need to acquire this token in the client which calls the web API – which also presents the UI to the user – e.g. a web app or a mobile client etc.

      This guide shows how to acquire the access token in a .NET desktop application and use it to call a web api:

      And this one shows the same, but calling from an ASP.NET web app:

      Hope this helps,

      1. Jarrod says:

        Hi Helge,

        That does indeed help. I was assuming that the /.auth/login/aad/callback did something unique, but that’s what I get for assuming…

        Thank you very much for the quick response, it helps a lot.

      2. Amirsasson says:

        i cant make this work.
        i have a azure AD b2c, configured Facebook as identity provider, configured my azure function as told above.
        everything seems to be fine but when replying AD to https://*** i get :
        You do not have permission to view this directory or page.
        can you gimme any lead that might suggest what am i doing wrong?

        1. Helge Mahrt says:

          Hello Amirsasson,

          Sorry for the delay, I’ve been rather busy these past months. I was able to reproduce the behavior when trying to log into my Function App in the browser with a Facebook user account which had never logged into my B2C before. That triggered the Sign-up flow, but if you configured your Functions App according to this blog post you only allowed the Sign-in flow (assuming that you always receive the token of a signed up user, because the API doesn’t have a UI and you’d handle the Sign-up flow in your UI). You can solve this by configuring a “Sign-up or sign-in” policy.

          Hope this helps,

  2. Simon Timms says:

    Hi Helge,

    I was able to get most of this working thanks so much for putting it together. One thing I wasn’t clear about was how I’d go about getting the bearer token. I set the callback URL to another function in the same function app but it, of course, couldn’t authenticate and I ended up in a bit of a loop. This despite setting the permissions on that other function to be anonymous. It seem like the authorization overrides that. In my scenario I’m attempting to do everything through functions rather than calling into a web application. I’m considering setting up another function app whose sole responsibility is to exchange the authorization code for an access token. Is there, perhaps, another way around that?


    1. Helge Mahrt says:

      IIRC, you should be able to get the Bearer token via the ClaimsPrincipal. E.g. I use this helper to get the B2C user id:

      public static class B2cHelper
          public static string UserID
                  return ClaimsPrincipal.Current?.Claims
                      .FirstOrDefault(x => x.Type == "")?.Value;
  3. Thank you Helge, a very good decent article to start with.

  4. Tom Manion says:

    Thanks for the awesome article. One thing that just doesn’t make sense to me is why it’s at the Function App “Family level” and not the “Per Function Level”. There’s no way to create a Function App with unauthenticated endpoints AND authenticated endpoints 🙁

    1. Helge Mahrt says:

      Thanks! I’m glad you liked it 🙂
      I’m not sure if the product group has anything in the pipeline, but I think it’s a technical limitation. Function Apps, under the hood, are also Web Apps. That becomes apparent when you dig deeper into the settings. For Web Apps, it’s either you protection everything – in kind of an external approach; wrap the whole thing in AAD or whatever you select – or, if you need granularity, you need access to the code. As we don’t have access to the code that runs our code in Functions Apps – because we want to forget about all that infrastructure – that option is not available.
      My suggestion: As additional Function Apps are “free” (you only pay for when your code runs), I’d create one instance for authenticated endpoints and one for open ones.

  5. No Sun Beach says:

    10/7/2017 – please excuse a few noob and possibly misguided questions… First, given its been 7 months , is this guide the the register app feature? Is it still the easiest way to authenticate an Azure function against AAD ? Is there really no way to configure Azure functions to auth against AAD without an separate App ? Default AAD created vs AAD B2C? Thanks!

    1. Helge Mahrt says:

      Hello No Sun Beach,

      Not sure I got all your questions right. If you provide me with more details I’ll try to answer as best as I can. 🙂

      As far as I know, this is till the only way to protect your Functions App with either AAD or B2C.
      I’m not sure what separate app you’re referring to. You have your Functions App and in its configuration settings you can set up auth against AAD or B2C.


  6. MtbikerWA says:

    Could this be used for a mobile or web all to log into B2C, then also send the resource token to Cosmos DB?

  7. Hi, I tried and Azure AD B2C works with Azure Functions V1, but I tried with V2 and could not make it work.


    Hello, excellent publication, I made the step by step as you, but I am getting this error at the moment I make the call of my function by the web browser (I enter my b2c credentials) and then I get this:
    The page can not be displayed because an internal server error has occurred.

    Any idea why it happens to me?

    Thank you.


Skip to main content