-
Notifications
You must be signed in to change notification settings - Fork 5k
Description
Library name and version
Azure.Communication.CallAutomation v1.5.0, Azure.Identity v1.16.0
Query/Question
I am attempting to integrate Azure Communication Services (ACS) with Azure AD authentication using ClientSecretCredential in my backend. However, despite following all documented steps, I am unable to issue tokens or access ACS resources via Azure AD. The ACS resource appears to be provisioned in the classic mode, and there is no option in the portal or ARM/Bicep to explicitly link it to my Entra ID tenant.
Steps Taken:
- Provisioned ACS resource via Azure Portal and via Bicep with linkedDomains (which failed due to invalid property ID).
- Created a custom ACS API proxy app registration and exposed scopes like Call.ReadWrite and Identity.ReadWrite.
- Assigned these scopes to my main application and granted admin consent.
- Authenticated using ClientSecretCredential and attempted to call ACS endpoints.
Received the following error:
Code
Status: 401 (Unauthorized)
ErrorCode: Denied
Content: {"error":{"code":"Denied","message":"Denied by the resource provider."}}
Issue:
ACS does not appear to recognize the Azure AD token issued by my app. The ACS resource is not linked to my Entra tenant, and the app registration does not expose native ACS permissions like Call.ReadWrite, Identity.ReadWrite, or Chat.ReadWrite. There is no documented or supported way to explicitly link ACS to Entra ID, nor to assign ACS-specific roles via IAM or app registration.
Request:
Please advise on how to:
Link an ACS resource to my Entra ID tenant to enable Azure AD authentication
Expose ACS-specific permissions in my app registration
Successfully authenticate and authorize ACS calls using Azure AD tokens
If this requires internal configuration or tenant-level enablement, I’d appreciate guidance or escalation to the appropriate engineering team.
Thank you for your time.
Environment
Azure
AspNet.Core 9.0
Visual Studio Pro 2022
Windows 11