I’m trying to secure a Serverless NodeJS Function App as mentioned in this example:

https://docs.cloudera.com/dataflow/cloud/azure-functions/topics/cdf-azure-function-secure-app.html

I set the Configuration settings to:
HTTP 1.1
HTTPS Only – On
TLS – 1.2
Client certificate mode – Require
No exclusion rules

I set the Authentication settings to:
App Service authentication – Enabled
Restrict access – Require authentication
Unauthenticated requests – Return HTTP 403 Forbidden
Token store – Enabled

OpenId Metadata URL, Client ID + Secret

In code I set a different http code to identify which step generated id.

export async function httpTrigger(request: HttpRequest, context: InvocationContext): Promise<HttpResponseInit> {

        if (!request.user) {
            return {
                status: 406, // Not Acceptable
            };
        }

    const name = request.query.get('name') || await request.text() || 'world';

    return { body: `Hello, ${name}!` };
};

app.http('httpTrigger', {
    methods: ['POST'],
    authLevel: 'anonymous',
    handler: httpTrigger
});

With any Bearer token (valid or invalid) I’m getting HTTP 406 response (from function app). If I change to authLevel ‘function’ every request is 401 Unauthorized.

Is there something I’m missing ?