Restrict Access with Azure Managed Identity in .NET Core Web API

Your API should be receiving a JWT token from your App. You need to configure your API to validate the token and reject ones that don't meet your requirements. You get some basic validation out of the box - the token must pass audience, issuer and signing certificate validation - but if you want to restrict it to a single identity then you need to tell it what that is.

There are a number of ways you can go about this, and Policy based authz is worth a read so you know the the approach (https://learn.microsoft.com/en-us/aspnet/core/security/authorization/policies?view=aspnetcore-6.0).

Your identity will have a unique, immutable identifier, the objectId of the managed identity. This gets transmitted on the subject claim on your JWT token, so you can lock down your API to that identity with a simple global policy

In your API start up where you have an AddAuthorization call, you can add a policy like so

services.AddAuthorization(options =>
{
    options.AddPolicy("OnlyMatchingSubject", policy =>
        policy.RequireAssertion(context => context.User.HasClaim(c =>
            c.Type is ClaimConstants.Sub && c.Value == "your-unique-subject-guid")));

    options.DefaultPolicy = options.GetPolicy("OnlyMatchingSubject");
});

Here, we say that your token must have a sub claim, and it must be a particular value to pass (just get your objectId for your identity from the portal), and then make that the default authentication policy.

Here's a full example for a dotnet 6 minimal API.

using System.Security.Claims;
using Microsoft.AspNetCore.Authentication.JwtBearer;
using Microsoft.Identity.Web;

var builder = WebApplication.CreateBuilder(args);

builder.Services
    .AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
    .AddMicrosoftIdentityWebApi(builder.Configuration.GetSection("AzureAd"));

builder.Services.AddAuthorization(options =>
{
    options.AddPolicy("OnlyMatchingSubject", policy =>
        policy.RequireAssertion(context => context.User.HasClaim(MatchesExpectedSubjectClaim())));

    var policy = options.GetPolicy("OnlyMatchingSubject");
    options.DefaultPolicy = policy;
    options.FallbackPolicy = policy;
});

var app = builder.Build();
app.UseAuthentication();
app.UseAuthorization();
app.MapGet("/", () => "Hello World!");

app.Run();

Predicate<Claim> MatchesExpectedSubjectClaim()
{
    return c => c.Type is "sub" && c.Value == "your-unique-subject-guid";
}

You'll need to set an AzureAd config in your settings, as per this documentation https://learn.microsoft.com/en-us/azure/active-directory/develop/scenario-protected-web-api-app-configuration#config-file