Federated Identity Credential (FIC) with a Managed Service Identity (MSI)

Setting up a Federated Identity Credential (FIC) with a Managed Service Identity (MSI) using Microsoft Identity Web involves several steps. Here's a high-level overview to get you started:

1. Create a User-Assigned Managed Identity:

   • In the Azure portal, navigate to your resource group and create a new user-assigned managed identity.

2. Configure Federated Identity Credential:

   • Go to the Microsoft Entra ID (formerly Azure AD) and configure a federated identity credential for your managed identity. This involves setting up the issuer and subject values to establish a trust relationship with your external identity provider. For details see Configure a user-assigned managed identity to trust an external identity provider

3. Set Up Microsoft Identity Web:

   • In your .NET application, use Microsoft.Identity.Web to handle authentication. You can configure it in your appsettings.json file. Here’s a sample configuration:

     {
       "AzureAd": {
         "Instance": "https://login.microsoftonline.com/",
         "TenantId": "your-tenant-id",
         "ClientId": "your-client-id",
         "ClientCredentials": [
           {
             "SourceType": "SignedAssertionFromManagedIdentity",
             "ManagedIdentityClientId": "your-managed-identity-client-id"
           }
         ]
       }
     }

4. Code Integration:

   • In your application code, use the Microsoft.Identity.Web library to acquire tokens and call downstream APIs. Here’s a basic example for a web app:

     services.AddAuthentication(OpenIdConnectDefaults.AuthenticationScheme)
          .AddMicrosoftIdentityWebApp(Configuration, "AzureAd")
             .EnableTokenAcquisitionToCallDownstreamApi()
             .AddInMemoryTokenCaches();

     or, for a web API:

     services.AddAuthentication(OpenIdConnectDefaults.AuthenticationScheme)
          .AddMicrosoftIdentityWebApi(Configuration, "AzureAd")
             .EnableTokenAcquisitionToCallDownstreamApi()
             .AddInMemoryTokenCaches();

   or, for a daemon app:

   var tokenAcquirerFactory = TokenAcquirerFactory.GetDefaultInstance();
   tokenAcquirerFactory.Services.AddMicrosoftGraph();
   var sp = tokenAcquirerFactory.Build();

5. Testing and Validation:

   • Ensure your application can successfully acquire tokens and access the required resources using the configured managed identity.

Reference

For detailed steps and additional configurations, you can refer to the Microsoft documentation¹ and the Microsoft Identity Web GitHub page².