I have Azure App 1 and System 1 where users in System 1 authenticates using SSO and System 1 receives a SAML token. There is also a Azure App 2, which is inside the same Azure, that works the same with System 2.

Then, System 1, using the SAML token from App 1, needs to call the System 2 API with a user token in order to make some actions on System 2 as a User.

The problems comes as the token from App 1 is not valid for App 2. What I could you to do a kind of transformation of the token to be able for App 2? Or which flow I could use?

I cannot use Machine2Machine flow as permission of both sides are not the same so System 2 cannot let System 1 to do whatever.

Any help on this? Thanks!

I already tried to pop up a SSO for System 2 while user is working on System 1 but this is not very UX friendly. Also M2M communication is not allowed as I said.

I’m expecting Sysyem 1 to be able to get a valid token for App 2 for the same User so the request in System 2 is correctly done.