我试图了解哪种身份验证适合Azure功能应用程序，因为我必须将功能应用程序端点曝光到外部团队。
我启用了Azure AD身份验证和计划共享应用程序注册 client_id 和 client_secret （endpoint oauth2/v2.0/token），他们将在其中生成携带者来验证和消费我的我的我端点。
我想知道，除了Azure-AD外，还没有其他最佳身份验证方法，因为我接触了外部团队。
请协助，谢谢。
I am trying to understand which authentication suits good for Azure Function app because I have to expose function app end point to external team.
I have enable Azure AD authentication and planning to share App registration client_id and client_secret (endpoint oauth2/v2.0/token) where they will generate bearer token to Authenticate and consume my endpoint.
I was wondering if there is any other best approach of authentication than Azure-AD because I am exposing to external team.
Please assist, Thank you.
发布评论
评论（1）
the most secure option is to request access tokens trough the
您还可以，配置并强制执行其他安全措施href =“ https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/overview” rel =“ nofollow noreferrer”>条件访问策略。与他们一起，您可以配置会话寿命，要求访问您的应用程序的选定或所有外部用户需要MFA，它们从合规设备进行身份验证，知名的IP范围或位置等等。
另外，在PAAS级别，您可以设置Azure应用服务访问限制。
the most secure option is to request access tokens trough the Azuthorization Grant Flow with PKCE. No secret is required, however if you need to use one, we recommend using certificate credentials which are asymmetric thus the exposure of the secret is more and better controlled.
You can also, configure token and enforce additional security measures trough Conditional Access policies. With them you can configure session lifetimes, require MFA for selected or all external users that access your application, that they authenticate from a compliant device, well known IP range or location, and more.
Also, and at the PAAS level, you can Set up Azure App Service access restrictions.