We have created an Azure Function which integrate with Active Directory App.
Here is our active directory App which have a self-signed certificate:-
now inside our Azure function we are passing those values to authenticate the Azure function with Azure Active Directory App:-
- Client Id
- Tenant ID
- Certificate Thumbprint
so i think all those 3 values are considered as public , and none of them are actually confidential (similar to secrets or passwords which should not be exposed) am i correct? and if this is the case, then where is the security in passing those 3 values? in other words, how we can be sure that only our Azure function is calling the Azure Ad APP? i am not sure if it is done using the certificate password which we have applied when creating the certificate?