Authorize requests to Azure Web PubSub resources with Microsoft Entra applications

Azure Web PubSub Service supports Microsoft Entra ID for authorizing requests with Microsoft Entra applications.

This article explains how to set up your resource and code to authenticate requests to the resource using a Microsoft Entra application.

Register an application in Microsoft Entra ID

The first step is to Register an application in Microsoft Entra ID:

After you register your application, you can find the Application (client) ID and Directory (tenant) ID values on the application's overview page. These GUIDs can be useful in the following steps.

Add credentials

After registering an app, you can add certificates, client secrets (a string), or federated identity credentials as credentials to your confidential client app registration. Credentials allow your application to authenticate as itself, requiring no interaction from a user at runtime, and are used by confidential client applications that access a web API.

• Add a certificate
• Add a client secret
• Add a federated credential

Add role assignments in the Azure portal

This section shows how to assign an Azure role to a service principal or managed identity for a Web PubSub resource. For detailed steps, see Assign Azure roles using the Azure portal.

1. In the Azure portal, go to your Web PubSub resource.

2. Select Access control (IAM) in the sidebar.

3. Select Add > Add role assignment.

   

4. On the Role tab, select a Web PubSub built-in role or custom role that includes the permissions required by your application.

   Role	Description	Use case
   Web PubSub Service Owner	Full access to data-plane APIs, including read/write REST APIs and Auth APIs.	Most commonly used for building an upstream server that handles negotiation requests and client events.
   Web PubSub Service Reader	Read-only access to data-plane APIs.	Use it when writing a monitoring tool that calls read-only REST APIs.

   Tip

   Follow the principle of least privilege by using a custom role with only the required Web PubSub data-plane permissions. To generate a client access token and use it to connect, the identity requires both Microsoft.SignalRService/WebPubSub/clientConnection/generateToken/action and Microsoft.SignalRService/WebPubSub/clientConnection/write. No narrower built-in role includes both permissions.

5. Select Next.

6. For Microsoft Entra application.

   1. In the Assign access to row, select User, group, or service principal.
   2. In the Members row, click select members, then choose the identity in the pop-up window.

7. For managed identity for Azure resources.

   1. In the Assign access to row, select Managed identity.
   2. In the Members row, click select members, then choose the application in the pop-up window.

8. Select Next.

9. Review your assignment, then click Review + assign to confirm the role assignment.

To learn more about how to assign and manage Azure roles, see these articles:

• Assign Azure roles using the Azure portal
• Assign Azure roles using the REST API
• Assign Azure roles using Azure PowerShell
• Assign Azure roles using the Azure CLI
• Assign Azure roles using Azure Resource Manager templates

Code samples with Microsoft Entra authorization

To create a WebPubSubServiceClient that uses Microsoft Entra authorization in .NET, Java, JavaScript, or Python, see Use Azure Identity with WebPubSubServiceClient.

Related content

• Overview of Microsoft Entra ID for Web PubSub
• Use Microsoft Entra ID to authorize a request from a managed identity to Web PubSub resources
• Disable local authentication