I'm looking for a way to authenticate users with Microsoft Entra ID before they reach the application infrastructure behind either Azure Application Gateway or Azure Front Door. Ideally, unauthenticated visitors would be sent through a sign-in flow first, so the backend apps only receive authenticated users. I'm offering a carton of beer for a working approach or configuration.
4 Answers
Azure Application Gateway has JSON Web Token authentication support in preview. It can validate tokens at the gateway and pass requests through only when the token is valid. It appears to work well in practice, but check the preview limitations before relying on it in production.
The main question is whether you need it to display a sign-in page when no token exists. Token validation alone usually rejects or redirects the request; the interactive sign-in flow may need to be handled separately.
Microsoft Entra Application Proxy is another option if you want Entra authentication in front of an internal application. It provides pre-authentication before the request reaches the app, although it may not fit every Application Gateway or Front Door architecture.
You could implement a Front Door rule that checks for the expected authentication cookie and redirects requests without it. Be careful, though: checking for a cookie is not the same as validating the token, so the actual session or token should still be verified by a trusted authentication component.
If the applications are hosted in Azure App Service, enable Easy Auth there. It handles Entra ID sign-in and authentication at the App Service layer, which may be simpler than trying to make the gateway perform the entire flow.
An API gateway can also help by validating Entra ID tokens and applying claims-based rules before requests reach the backend.
This is being used successfully for one solution and does the token-validation part well.