Azure FHIR service returns "Authentication failed"

Hello Varshith Meesala,
Thank you for reaching out Q&A.

You have deployed an Azure API for FHIR service and tried to call its /Patient endpoint from Postman using:

• A JWT issued by Auth0 (you added Auth0 as an extra IdP on the FHIR service) • A JWT issued by Microsoft Entra ID (you created an AAD App, granted it the FHIR Contributor role, and requested a client-credentials token)

In both cases you get HTTP 401 Unauthorized. You have verified that the tokens arrive in the Authorization header and that their basic claims look reasonable, but the FHIR service is rejecting them.

Steps to Follow

1. Inspect your current FHIR service Authentication blade • In the Azure portal, navigate to your FHIR service > Settings > Authentication. • Under “Identity providers” confirm you see both your AAD and your Auth0 entries. • Under “Allowed token audiences” confirm you have the exact App ID URI shown on your FHIR service Overview.
2. Configure Auth0 so its tokens carry the FHIR audience a. In the Auth0 dashboard create an API: – Name: FHIR-API – Identifier: https://<your-fhir-service-host> – Scopes: openid, profile (or others you need) b. In Applications > Machine to Machine, authorize your Postman client to call that API.
3. Update the FHIR service to trust Auth0 a. In Authentication > Identity providers > + Add provider > Choose “OpenID Connect” – Name: Auth0 – Issuer URL: https://<your-auth0-domain>/.well-known/openid-configuration – Client ID: <Auth0 M2M application client_id> – Client Secret: <Auth0 M2M application client_secret> b. Under “Allowed token audiences” add exactly: https://<your-fhir-service-host>
4. Verify Azure AD setup a. Confirm your AAD App Registration’s App ID URI matches the FHIR service’s App ID URI. b. In FHIR service Authentication > Identity providers, the AAD entry’s Issuer URL must be https://login.microsoftonline.com/<tenantId>/v2.0/ c. That AAD entry’s Allowed audiences must include the same App ID URI.
5. Acquire tokens with correct audience/scope • For Auth0 (client_credentials): POST https://<your-auth0-domain>/oauth/token body (x-www-form-urlencoded): grant_type=client_credentials client_id=<Auth0-client-id> client_secret=<Auth0-secret> audience=https://<your-fhir-service-host>

• For Azure AD (v2.0 endpoint): POST https://login.microsoftonline.com/<tenantId>/oauth2/v2.0/token body (x-www-form-urlencoded): client_id=<AAD-app-client-id> client_secret=<AAD-secret> scope=<App-ID-URI>/.default grant_type=client_credentials

Reference: https://dori-uw-1.kuma-moon.com/en-us/answers/questions/2246997/getting-401-unauthorized-when-accessing-azure-fhir

I am sorry but I do not see a "Choose OpenID Connect" option in the authentication section of the FHIR service. Rest of the steps that you have mentioned are steps I have already configured and written down in the question.

The problem still persists. To focus the problem, answer this "How do I connect an external IdP like auth0 to authenticate requests to Azure Health Data Services Fhir Service without using EntraID?"

Hello Varshith Meesala,

Thanks for the follow-up question. Here are a few points to consider on how to connect an external IdP, such as Auth0, to authenticate requests to Azure Health Data Services FHIR service without using Entra ID.

Using Auth0 (or Another Identity Provider) with Azure Health Data Services FHIR – Without Only Using Entra ID

1. How FHIR Service Usually Works Normally, the Azure FHIR service uses Microsoft Entra ID (formerly Azure AD) for sign‑in. It will only accept login tokens from providers it knows and trusts.
2. You Can Use Auth0 or Other Logins – But Not Directly from the Portal You can add up to two extra login providers like Auth0, but you can’t just click and add them in the Azure portal. Instead, you must use Azure Resource Manager (ARM) templates or the Azure CLI to add them under a setting called smartIdentityProviders.
3. When you set this up, you have entered:

• Your Auth0 domain’s authority URL (its OpenID Connect link)
• The client ID from Auth0
• The audience (this must be your FHIR service’s address)
• The permissions you want to allow (called “allowed data actions” in FHIR)

4. Auth0 Tokens Must Follow FHIR’s Rules:

• Have the aud field match your FHIR service URL
• Include a fhirUser claim so FHIR knows who you are
• Have the right scp (scopes) if you’re using SMART on FHIR
• Match the permissions you set in step 3

5. Another Way is to Use Azure AD B2C or Entra External ID If you don’t want to connect Auth0 directly, you can use Azure AD B2C or Microsoft Entra External ID. These work like a middleman – they accept Auth0 logins, then issue a Microsoft‑style token that the FHIR service already understands. (Note: Azure AD B2C is being replaced by Entra External ID for new customers.)
6. You can’t just give the FHIR service your Auth0 token as‑is. You must either:

• Configure Auth0 as a smartIdentityProvider (via ARM/CLI), or
• Use Entra ID through B2C or External ID.

Reference Documents:

• Configure extra login providers for Azure FHIR: https://dori-uw-1.kuma-moon.com/en-us/azure/healthcare-apis/fhir/configure-identity-providers
• Authentication details for Azure Health Data Services: https://dori-uw-1.kuma-moon.com/en-us/azure/healthcare-apis/authentication-authorization
• Azure AD B2C setup for FHIR: https://dori-uw-1.kuma-moon.com/en-us/azure/healthcare-apis/fhir/azure-ad-b2c-setup
• FAQ: https://dori-uw-1.kuma-moon.com/en-us/azure/healthcare-apis/fhir/fhir-faq

Kindly let us know if the above helps or you need further assistance on this issue.

Hello Varshith Meesala,

Just checking to see if you have a chance to check my previous response and helped, do let me know if you have any further questions on this. 

Hello Varshith Meesala,

Just checking to see if you have a chance to check my previous response and helped, do let me know if you have any further questions on this.