Followed some guides as to AAD protect my web API made in .NET 7. Then proceeded to follow another to get SPFx to contact this API. All say we need to give authorization through webApiPermissionRequests property on package-solution.json.

For my testing I can get to the API without this configuration. Yes, it rightly secured. I tested it with Postman and need to request the Token and send it with every request. I understand that using AadHttpClient manages some of the heavy lifting of making requests against AAD protected Web APIs (the main reason I want to use AAD secured API), but I would think that the app should still make a check against the requested permissions.

I'm testing it with web API at localhost, for now. Not sure if that affects the check.

1 Answer 1


The permission was already previously granted on that tenant. It only needs to be done once per scope.

API permission requests in a rather poorly implemented feature by Microsoft. Read more about it here: https://www.voitanos.io/blog/consider-avoiding-declarative-permissions-with-azure-ad-services-in-sharepoint-framework-projects/

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.