Azure Active Directory Authentication with Spring Security
Fast recall
Quick revision
Core answer
Understanding of OAuth2/OIDC flow in the context of Azure AD and how Spring Security integrates with external identity providers.
Manually parsing JWT tokens in filters instead of using Spring Security's built-in resource server support with Azure AD's JWKS endpoint.
Explain app roles vs. groups for authorization, the on-behalf-of flow for service-to-service calls, and conditional access policies.
Interview-ready guide
Interview answer
Azure Active Directory (Azure AD, now Entra ID) integration with Spring Security works through standard OAuth2 and OIDC protocols — which means your Spring Boot service participates in the Azure identity ecosystem using the same OAuth2 support built into Spring Security.
How it works
- Register your Spring Boot application in Azure AD as an App Registration; Azure AD acts as the OAuth2 authorization server and OIDC identity provider
- Add
spring-cloud-azure-starter-active-directory; configurespring.cloud.azure.active-directory.credential.client-id,tenant-id, andclient-secret; Spring Security auto-configures an OAuth2 login flow and JWT validation for Bearer tokens
Token validation for API-only services
- For REST APIs that accept Bearer tokens (no browser login): configure
spring.cloud.azure.active-directory.application-type=web-api; the starter configures Spring Security to validate incoming JWT tokens from Azure AD - The JWT contains the user's roles and claims — use
@PreAuthorize("hasRole('ROLE_Admin')")on controller methods; Spring Security extracts roles from therolesclaim in the Azure AD JWT automatically
Service-to-service authentication with Managed Identity
- For a Spring Boot service calling another Azure service or a downstream API: use Managed Identity with the Azure Identity SDK;
DefaultAzureCredentialacquires a token for the target resource without credentials in code - Register both services as App Registrations; grant the calling service's Managed Identity the appropriate Application Role on the target service's App Registration
Multi-tenant configuration
- A multi-tenant app registration accepts tokens from any Azure AD tenant — configure
spring.cloud.azure.active-directory.profile.tenant-id=common; validate thetidclaim in the token to restrict which tenants are allowed
Azure Active Directory Authentication with Spring Security
Direct Answer
Use the spring-cloud-azure-starter-active-directory dependency to configure OAuth2/OIDC authentication. Azure AD acts as the authorization server, issuing JWT tokens that Spring Security validates via the JWKS endpoint.
Common Mistakes & Pitfalls
Manually parsing JWT tokens in filters instead of using Spring Security's built-in resource server support with Azure AD's JWKS endpoint.
Check your understanding
Answer these without looking back at the article.
- What is the difference between Azure AD app roles and groups for authorization?
- How does the OAuth2 On-Behalf-Of flow work for API-to-API calls?
- How do you validate Azure AD JWT tokens manually if you cannot use Spring Cloud Azure?
Related interview prep categories
1Looking for a structured roadmap?
Every module on this page is also part of the full Java backend interview track.