Why Zero Trust matters for modern .NET APIs
Imagine a developer who spends weeks polishing a Minimal API only to discover that a stolen credential grants unrestricted access to sensitive data. In 2023, Microsoft reported a 30% rise in breaches caused by compromised tokens, underscoring that perimeter defenses are no longer sufficient. Zero Trust flips the model: every request, user, and device is treated as untrusted until proven otherwise. For .NET 8 Minimal APIs—lightweight, high‑performance endpoints—this mindset eliminates the hidden attack surface that traditional monoliths often expose.
Core Zero Trust principles in the Azure ecosystem
Azure implements Zero Trust through three tightly coupled pillars: identity verification, device compliance, and least‑privilege access. Azure Active Directory (now branded Entra ID) provides the identity layer, Azure API Management (APIM) enforces policy at the edge, and Microsoft Defender for Cloud continuously audits configurations. By aligning your Minimal API with these services you gain built‑in MFA, conditional access, and real‑time risk assessment without writing custom security code.
Setting up Entra ID for a Minimal API
Start by registering the API in Entra ID. Choose "Expose an API" and define a scope such as api://my-minimal-api/.default. Then create a client application (for example a Blazor WebAssembly front‑end) and grant it the newly defined scope. In your .NET 8 project add the Microsoft.Identity.Web package and configure authentication in Program.cs as shown below.
using Microsoft.AspNetCore.Authentication.JwtBearer;<br/>using Microsoft.Identity.Web;<br/>var builder = WebApplication.CreateBuilder(args);<br/>builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)<br/> .AddMicrosoftIdentityWebApi(builder.Configuration.GetSection("AzureAd"));<br/>builder.Services.AddAuthorization();<br/>var app = builder.Build();<br/>app.UseAuthentication();<br/>app.UseAuthorization();<br/>app.MapGet("/weather", [Microsoft.AspNetCore.Authorization.Authorize] () => new[]{<br/> new { Date = DateTime.UtcNow, TempC = 22 }<br/>});<br/>app.Run();Notice the use of the [Authorize] attribute directly on the endpoint delegate—a concise way to enforce token validation for every call.
Leveraging Azure API Management as a policy enforcement point
APIM sits in front of your Minimal API and can reject malformed or expired JWTs before they hit your code. Create an APIM instance, import the API via the OpenAPI definition generated by dotnet swagger tofile, and add an inbound validate-jwt policy. The policy extracts the token from the Authorization header, validates the signature against the Entra ID public keys, and checks the aud claim.
<inbound><validate-jwt header-name="Authorization" failed-validation-httpcode="401" failed-validation-error-message="Invalid token" token-signing-key="{{enrollmentKey}}" require-scheme="Bearer" ><required-claims><claim name="aud" match="any">api://my-minimal-api/.default</claim></required-claims></validate-jwt><base-url>https://myapi.azurewebsites.net</base-url></inbound>Because the policy runs in the APIM gateway, malicious traffic is blocked at the edge, reducing load on your .NET service and providing a clear audit trail in Azure Monitor.
Practical tips for claim checks and token lifetimes
Even with APIM in place, you should still validate claims inside the Minimal API for defense‑in‑depth. Use the HttpContext.User object to read custom claims such as role or department. For example, a finance endpoint might require role=FinanceReader:
app.MapGet("/finance/report", [Microsoft.AspNetCore.Authorization.Authorize(Roles="FinanceReader")] (HttpContext ctx) => { /* business logic */ });Set token lifetimes to a minimum of 1 hour and enable refresh token rotation in Entra ID. Short lifetimes limit the window for replay attacks, while rotation forces compromised tokens to become useless after the first use.
Monitoring, logging, and continuous improvement
Integrate Azure Monitor and Log Analytics with both your Minimal API and APIM. Create alerts for anomalous authentication failures—e.g., more than 100 failed JWT validations within five minutes. Combine these alerts with Microsoft Defender for Cloud’s Secure Score to track compliance with Zero Trust benchmarks. Regularly review the Secure Score dashboard; a score above 85% indicates a mature Zero Trust posture.
Sources
Microsoft Docs – Zero Trust architecture; Azure AD developer guide; Azure API Management policy reference.
Author: Mahmut Sarıkaya — sarikayadev.com
