This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(131.20000000000002, 27%, 22%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EAS%3C/text%3E%3C/svg%3E)
I have developed a Web-Api application which does access 3rd party users mail. The application is obtaining access through MSAL.NET with a PublicClientApplicationBuilder sample of which is shown at the following link: https://github.com/AzureAD/microsoft-authentication-library-for-dotnet/wiki/Client-Applications/351a92cd4066676281d9997c13e9e192db105080
It was working OK on my development machine, however I have now deployed the app on Azure App Service where it is not working.
Trouble is, that I can only provide a localhost redirect Uri for the Authentication flow. However, from a Azure App Service cannot listen to localhost - Access is denied.
Any suggestion please?
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(211.20000000000002, 61%, 30%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EBS%3C/text%3E%3C/svg%3E)
you need to register the hosted apps actual reply url in addition to localhost in entra.
note: you are using the docs for a previous version. you should use the new docs:
Whichever reply url I have registered the outcome is the same. 'Only loopback url is allowed'
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(144, 36%, 23%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ESH%3C/text%3E%3C/svg%3E)
Hi Avrohom Singer ,
Thankyou for Your Response.
This issue because PublicClientApplication in MSAL.NET is designed for desktop or mobile applications where loopback redirect URIs are commonly used. Azure App Service is not suitable for using a PublicClientApplication, as it doesn't support listening on localhost.
PublicClientApplication is not suitable for Azure App Service. Refactor your application to use ConfidentialClientApplication in MSAL.NET.var confidentialClient = ConfidentialClientApplicationBuilder.Create("<client-id>")
.WithClientSecret("<client-secret>")
.WithRedirectUri("https://<your-app-name>.azurewebsites.net")
.Build();
var authResult = await confidentialClient.AcquireTokenForClient(new[] { "https://graph.microsoft.com/.default" }).ExecuteAsync();
https://<your-app-name>.azurewebsites.net).appsettings.json or as environment
variables in Azure App Service.{
"AzureAd": {
"Instance": "https://login.microsoftonline.com/",
"TenantId": "<tenant-id>",
"ClientId": "<client-id>",
"ClientSecret": "<client-secret>",
"RedirectUri": "https://<your-app-name>.azurewebsites.net"
}
}
"Only loopback URL is allowed", ensure the app is using ConfidentialClientApplication instead of PublicClientApplication. Check logs using App Service Diagnostics to identify additional issues.
Dear Shree Hima Bindu Maganti,
Many thanks for suggestion.
However trying it out, I am being presented with following exception:
An unhandled exception occurred while processing the request.
MsalServiceException: A configuration issue is preventing authentication - check the error message from the server for details. You can modify the configuration in the application registration portal. See https://aka.ms/msal-net-invalid-client for details. Original exception: AADSTS7000229: The client application xxxxxxxxxxxxxxxxxxxxxx is missing service principal in the tenant xxxxxxxxxxxxxxxxxxxxxxxxx. See instructions here: https://go.microsoft.com/fwlink/?linkid=2225119 Trace ID: d368852d-d077-4446-9b59-5b3b6c4b0900 Correlation ID: b8901484-c569-48c2-a594-f55e3fb3f30d Timestamp: 2024-12-15 12:36:22Z
The it looks like, is that a ConfidentialClientApplication is meant to obtain authorisation to my very own account. What I am after is: to get access to other user's account by having the interactively grant consent for my app to access their email.
To me it looks like a ConfidentialClientApplication is for obtaining authorisation token to my very own account. Whereas, what I am trying to achieve is access to other user's account by letting them interactively grant access to their resources to my app.
To grant access to to webserver, that webserver needs to be registered with each authentication server, and have a clientid, secret and reply url.
if you are trying to do a generic mail client access then it needs a local app. For a webserver this is a JavaScript app to get the token to pass to server.
Hi Avrohom Singer ,
Following up to see if you have chance to check my previous response and help us with requested information is helpful.
Hi Avrohom Singer ,
Following up to see if you have chance to check my previous response and help us with requested information is helpful.
Hi Avrohom Singer ,
Thank you for your response and for providing additional details.
You need to switch to Authorization Code Flow to allow other users to interactively grant access to their resources.
For web apps deployed in Azure App Service, ConfidentialClientApplication can still be used for interactive logins when users authorize your app.
Replace your PublicClientApplication logic .
var confidentialClient = ConfidentialClientApplicationBuilder.Create(clientId)
.WithClientSecret(clientSecret) // Add your client secret here
.WithRedirectUri("https://<your-app-name>.azurewebsites.net/signin-oidc")
.Build();
// Authorization code flow - acquire a token interactively
var authResult = await confidentialClient.AcquireTokenByAuthorizationCode(scopes, authorizationCode).ExecuteAsync();
The code obtained after redirecting users to Azure AD login.
Scopes representing the permissions your app needs.
The error AADSTS7000229 indicates that your app registration doesn't have a service principal in the tenant.
Ensure Service Principal Exists.
Go to the Azure Portal > Azure Active Directory > Enterprise Applications.
Search for your app by its Client ID.
If the app is not found, re-create the service principal.
az ad sp create --id <your-client-id>
Navigate to Authentication in your app registration.
Ensure Redirect URI matches your application URL, e.g., https://<your-app-name>.azurewebsites.net/signin-oidc.
To allow users to log in and authorize your app interactively,
https://login.microsoftonline.com/{tenant}/oauth2/v2.0/authorize
?client_id={clientId}
&response_type=code
&redirect_uri={redirectUri}
&scope={scopes}
&response_mode=query
&state=12345
Use common for multi-tenant apps or your specific tenant ID.
Permissions like User.Read or Mail.Read.
Upon user consent, Azure AD will redirect back with an Authorization Code, which you can exchange for a token using AcquireTokenByAuthorizationCode.
https://learn.microsoft.com/en-us/entra/identity-platform/v2-oauth2-auth-code-flow
If the answer is helpful, please click "Accept Answer" and kindly upvote it.