---
title: "Configure web app authentication"
slug: "configure-web-app-authentication"
description: "Configure App Service built-in authentication, enable managed identity, assign the BISAdmin app role, and restart your Azure web app for D365 F&SCM."
tags: ["Task", "Connectivity Studio", "CS"]
status: "new"
updated: 2026-11-10T08:21:22Z
published: 2026-11-10T08:21:22Z
canonical: "docs.staedean.com/configure-web-app-authentication"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.staedean.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Configure web app authentication

After you [register the application with Microsoft Entra ID](/data-management/docs/register-application-with-microsoft-entra-id), connect the web app to the app registration, enable the managed identity of the web app, and give administrators access to the web app settings.

## Configure authentication

Connect the web app to the app registration with App Service built-in authentication. For more information, refer to [Configure Microsoft Entra authentication](https://learn.microsoft.com/en-us/azure/app-service/configure-authentication-provider-aad) and [Authentication and authorization in Azure App Service](https://learn.microsoft.com/en-us/azure/app-service/overview-authentication-authorization).

1. In the Azure portal, open the web app, and go to **Settings** > **Authentication**.
2. Add the **Microsoft** identity provider, or edit it if it already exists.
3. Select the app registration that you created.

The **Client ID** is the **Application (client) ID** from the **Overview** page of the app registration. App Service generates the client secret for sign-in, and stores it in the `MICROSOFT_PROVIDER_AUTHENTICATION_SECRET` app setting.
4. In the **Allowed token audiences** field, enter the **Application ID URI** of the app registration.

You can find this value on the app registration, under **Expose an API**. For example: `api://<Application (client) ID>`. For more information, refer to [Allowed token audiences](https://learn.microsoft.com/en-us/azure/app-service/configure-authentication-provider-aad#allowed-token-audiences).
5. Click **Save**.

## Enable the managed identity

Enable the system-assigned managed identity of the web app. The web app uses this identity to call D365 F&SCM, so no client secret, client ID or tenant ID is stored for that call. The identity is not used for user sign-in. For more information, refer to [Add a system-assigned identity](https://learn.microsoft.com/en-us/azure/app-service/overview-managed-identity#add-a-system-assigned-identity).

1. On the web app, go to **Settings** > **Identity**.
2. On the **System assigned** tab, set **Status** to **On**.
3. Click **Save**, and confirm with **Yes**.

## Assign the BISAdmin app role

Users with the **BISAdmin** app role can change the settings of the web app. Without this role, the **Edit settings** button is not shown when a user browses the web app. Create the app role on the app registration, and assign it to users or groups in the enterprise application. For more information, refer to [Add app roles to your application](https://learn.microsoft.com/en-us/entra/identity-platform/howto-add-app-roles-in-apps) and [Assign users and groups to an application](https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/assign-user-or-group-access-portal).

1. On the app registration, go to **App roles**, and click **Create app role**.
2. Enter the values for the app role.

> [!NOTE]
> **Note**
> 
> Enter the value exactly as `BISAdmin`. The web app checks for this value to show the **Edit settings** button.
  - **Display name**: Enter `BISAdmin`.
  - **Allowed member types**: Select **Users/Groups**.
  - **Value**: Enter `BISAdmin`.
  - **Description**: Enter a description, for example `BISAdmin role`.
  - **Do you want to enable this app role?**: Select the checkbox.
3. Click **Apply**.
4. On the **Overview** page of the app registration, click the **Managed application in local directory** link.

This link opens the enterprise application of the app registration. You assign users and groups to the app role in the enterprise application.
5. Go to **Users and groups**, and click **Add user/group**.
6. Select the users or groups that manage the web app settings, select the **BISAdmin** role, and click **Assign**.
7. If a user or group also has the **Default Access** role, select that assignment, and click **Remove assignment**.

Keep only the **BISAdmin** assignment for these users and groups.

## Restart the web app

Restart the web app to apply the authentication, identity and app role settings.

1. On the web app, go to the **Overview** page.
2. Click **Restart**, and confirm.

## Related

- [Set up inbound web service - Azure App Service](/set-up-inbound-web-service-azure-app-service.md)
- [Set up Azure Web App](/set-up-azure-web-app.md)
- [Register application with Microsoft Entra ID](/register-application-with-microsoft-entra-id.md)
- [Register Microsoft Entra ID application in D365 F&SCM](/register-microsoft-entra-id-application-in-d365-fscm.md)
- [Configure the App Service web app](/configure-the-app-service-web-app.md)