Why the URL of Azure App service can't be used as the Application ID URI in Azure AD?

Question

The azure app service provided an URL in such format https://your-app-name.azurewebsites.net

When Expose an API in azure app registration the Application ID URI is needed. But when I use the url provided by the azure app service I got the following error:

Values of identifierUris property must use a verified domain of 
the organisation or its subdomain: https://your-app-name.azurewebsites.net

the URL provided by the app service is not a verified domain? and how can I make it verified?

Answer 1

Application ID URI is an identifier that can be used instead of the client ID when specifying a scope defined in that app.

It has nothing to do with authentication redirect URIs, where it would need to match your app hosting.

Answer 2

Agree with juunas and this is just additional description. Screenshot below contained the error you met and one of the supported App ID URI pattern .

I'm afraid that the reason for exposing API is that you want to protect your web API with Azure AD . The App ID URI here is used for the authorization. Your web app also requires to configure the audience, then after you integrate Azure AD authorization into your application, the scope, the audience and other claims containing in the incoming access token will all be verified. I have a sample which is based on a web api. You can see the configuration for Azure AD authorization.

And https://your-app-name.azurewebsites.net is for authentication which used for redirect from microsoft identity platform back to your own web app. The scenario can be opening your own web page which requiring user to sign in --> redirect to microsoft sign in page --> sign in then redirect back to your web page. So we need to identify the redirect URL in Azure AD.