I have an azure function as a downstream api that i want to connect to my blazor (wasm) web app.

I have 2 app registrations – 1 for the web application (to authenticate users) and 1 for the downstream Api (to azure function).

I expose an api on my function api and assign it to my web application application registration. like so :

Exposing on the function api :

And setting it as a scope on my web application app reg.

All straight forward.

And here is my code on some pages that are needed to disagnose :

Program.cs

builder.Services.AddScoped<APIAuthMessageHandler>();
var myAPI = builder.Configuration.GetSection("FuncAPI")["baseurl"];
builder.Services.AddHttpClient("ApiHTTPClient", HttpClient => HttpClient.BaseAddress = new Uri(myAPI!))
    .AddHttpMessageHandler<APIAuthMessageHandler>();

builder.Services.AddScoped(sp => new HttpClient { BaseAddress = new Uri(builder.HostEnvironment.BaseAddress) });

builder.Services.AddMsalAuthentication(options =>
{


    builder.Configuration.Bind("AzureAd", options.ProviderOptions.Authentication);
    // NOTE: no "api://" when providing the scope
    options.ProviderOptions.DefaultAccessTokenScopes.Add("a6d9a347-594b-4cea-939a-9ac4f67645c7/user_impersonation");
    //options.ProviderOptions.DefaultAccessTokenScopes.Add("afc0e68e-c87a-4142-9320-a56e74e0a541");
    options.ProviderOptions.LoginMode = "redirect";
});

APIAuthMessageHandler

    public APIAuthMessageHandler(IAccessTokenProvider provider, NavigationManager navigationManager, IConfiguration _configuration) :base(provider, navigationManager)
    {
        var baseurl = _configuration.GetSection("FuncAPI")["BaseURL"];

        
        ConfigureHandler(
            authorizedUrls: new[] { baseurl }, scopes: new[] { "api://a6d9a347-594b-4cea-939a-9ac4f67645c7/user_impersonation" });
    }
}

}

and here is my get command :

   try
   {
       await base.OnInitializedAsync();

       HttpClient client1 = factory.CreateClient("ApiHTTPClient");
       HttpResponseMessage respone1 = await client1.GetAsync("Function1");
       //respone1.EnsureSuccessStatusCode();
       content1 = await respone1.Content.ReadAsStringAsync();
   }
   catch (AccessTokenNotAvailableException exception)
   {
       exception.Redirect();
   }

when i connect the app registration to azure function (via easy auth) it just doesnt read the helloworld function i am trying to work with.

Can anyone give me any tips why i am getting the error :

You do not have permission to view this directory or page.

Not worried if i am exposing guids – as this is a throw away environment.