Securing APIs with Microsoft Entra ID: scope, client and token validation
A practical guide to protecting an API with Microsoft Entra ID: registering the API, exposing a scope, and registering the client that requests it. It walks through a .NET Core API using Microsoft.Identity.Web, a React client using MSAL, and a .NET web app calling a downstream API. The same token checks apply to any backend stack.