title: Invoking a OAuth enabled consumption logic app from Web API
body: <p>My consumption logic app is OAuth enabled which means the trigger to the logic app requires a bearer token.
  Im using Managed identities for the AD authentication. I have Managed Identity enabled on my AppService and on my Logic App. I have also assigned the appropriate roles for the AppService Service Principal to the Logic App</p>
  <pre><code>       $appServiceIdentity = Get-AzADServicePrincipal -DisplayName $(appservicename) | select -ExpandProperty Id
     $isAppServiceInLogicAppContributor = (Get-AzRoleAssignment -ObjectId $appServiceIdentity -RoleDefinitionName &quot;Contributor&quot; -Scope  &quot;/subscriptions/$(azureSubscriptionId)/resourceGroups/$(resourceGroupName)/providers/Microsoft.Logic/workflows/$(thelogicappName)&quot;)      
     if (!$isAppServiceInLogicAppContributor)
     {
       Write-Host &quot;Assigning App service to Logic App Contributor...&quot;
       New-AzRoleAssignment -ObjectId $appServiceIdentity -RoleDefinitionName &quot;Contributor&quot; -Scope &quot;/subscriptions/$(azureSubscriptionId)/resourceGroups/$(resourceGroupName)/providers/Microsoft.Logic/workflows/$(thelogicappName)&quot;
     }
  </code></pre>
  <p>The roles are assigned correctly and visible on the Azure portal as well</p>
  <p><a href="https://i.stack.imgur.com/6yhCy.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/6yhCy.png" alt="enter image description here" /></a></p>
  <p>The Logic App ARM template has the OAuth settings for the triggers</p>
  <pre><code>                    &quot;triggers&quot;: {
                      &quot;openAuthenticationPolicies&quot;: {
                          &quot;policies&quot;: {
                              &quot;endpoint-oauth-policy&quot;: {
                                  &quot;type&quot;: &quot;AAD&quot;,
                                  &quot;claims&quot;: [
                                      {
                                          &quot;name&quot;: &quot;iss&quot;,
                                          &quot;value&quot;: &quot;[concat('https://sts.windows.net/', variables('tenantId'), '/')]&quot;
                                      },
                                      {
                                          &quot;name&quot;: &quot;aud&quot;,
                                          &quot;value&quot;: &quot;https://management.core.windows.net/&quot;
                                      }
                                  ]
                              }
                          }
                      },
  </code></pre>
  <p>The Web API uses DefaultAzureCredential library to fetch the token. Im not specifying any environment variables for the Identity check. The code for fetching the token looks like below</p>
  <pre><code>            var tokenClient = new DefaultAzureCredential();
          var token = tokenClient.GetToken(&quot;https://management.azure.com/.default&quot;);
  </code></pre>
  <p>However I get HTTP 401 with the tokens. The token contains the aud and issuer with correct values.</p>