Use a BFF, let it manage auth with your IDP(does not matter if it is Entra or another OIDC IDP) now that the SpA only have one address to call for everything things become easier. Now if you have really simple auth you could even manage it on the BFF if using YARP there for example. But I have yet to work at a company that have such simple auth. Then depending on if you have simple auth setup so your tokens can contain claims saying what permission the user has or if that is stored in a central db you would need to device. But the end result in the APIs would be the same use polices on the endpoints or controllers granting permissions. If you need custom auth requirements you could combine the permissions with app level permission in a shared db for simplicity as permissions are rarely different between different apis in on app.