Azure Container App connection with Microsoft Graph through EntraID

Hello Tomasz Rogala,

The X-Ms-Token-Aad-Access-Token header is issued for the Container App's host, and its audience claim does not match Microsoft Graph, so signature validation fails ("Key was found, but use of the key to verify the signature failed").

The simplest way for Azure Container App to call Microsoft Graph is connect using app credentials (Client Credentials Flow) with MSAL or make use of Managed Identity:

from msal import ConfidentialClientApplication

import requests

TENANT_ID = "your-tenant-id"

CLIENT_ID = "your-client-id"

CLIENT_SECRET = "your-client-secret"

app = ConfidentialClientApplication(

    CLIENT_ID,

    authority=f"https://login.microsoftonline.com/{TENANT_ID}",

    client_credential=CLIENT_SECRET

)

token = app.acquire_token_for_client(scopes=["https://graph.microsoft.com/.default"])

headers = {"Authorization": f"Bearer {token['access_token']}"}

r = requests.get("https://graph.microsoft.com/v1.0/users", headers=headers)

print(r.json())

Let me know if any further queries - feel free to reach out!