Use app acquisition for EasyAuth app authentication results

[Ignacio Inglese (iNinja)]

Summary

• Use the existing MSAL client credentials flow for both EasyAuth app-token methods.
• Return a genuine app-only authentication result instead of the provider token associated with the signed-in user.
• Keep EasyAuth user provider tokens opaque and preserve the existing user-token behavior.

Release notes

EasyAuth GetAuthenticationResultForAppAsync now performs client-credential acquisition and returns an app-only authentication result instead of the provider token associated with the signed-in user. Applications using this method must have valid application credentials and the required application permissions.

EasyAuth user-token behavior is unchanged. User-token methods continue to return the provider token supplied by App Services authentication for the current request.

Testing

• 6 focused AppServicesAuthenticationTokenAcquisitionTests passed on .NET 8.

[Copilot]

Pull request overview

Enforces constraints on EasyAuth-provided user tokens while preserving unconstrained opaque-token behavior.

Changes:

• Validates explicit tenant, audience, and delegated scopes.
• Adds sovereign-cloud Microsoft Graph alias handling.
• Separates app-token and user-token result behavior.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
src/Microsoft.Identity.Web/AppServicesAuth/AppServicesAuthenticationTokenAcquisition.cs	Implements token constraints and tenant-aware app acquisition.
tests/Microsoft.Identity.Web.Test/AppServicesAuthenticationTokenAcquisitionTests.cs	Adds focused EasyAuth behavior tests.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Bogdan Gavril (bgavrilMS)]

Clients MUST not parse tokens.

[Nilesh Choudhary (4gust)]

I tested the manually and the fix works.