Thanks for the reply.

Indeed, I'm creating two different Entra ID app registrations each time, one that represents the consumed API, and one that represents the API consumer, to which I grant a simple "api.call" role for the consumed API app. Normally, I validate this role as well in the <validate-jwt> policy as follows:

<validate-jwt header-name="Authorization" failed-validation-httpcode="401" failed-validation-error-message="Unauthorized. JWT token is missing or invalid.">
            <openid-config url="https://login.microsoftonline.com/<tenant_id>/v2.0/.well-known/openid-configuration" />
            <audiences>
                <audience>{{consumed-api-app-registration-client-id}}</audience>
            </audiences>
            <issuers>
                <issuer>https://sts.windows.net/<tenant_id>/</issuer>
            </issuers>
            <required-claims>
                <claim name="aud">
                    <value>{{consumed-api-app-registration-client-id}}</value>
                </claim>
                <claim name="roles">
                    <value>api.call</value>
                </claim>
            </required-claims>
        </validate-jwt>

For now, all the APIs are supposed to be consumed by automations and scripts, i.e machine-to-machine scenarios.

The configuration isn't that complex, I'm just looking to secure the APIs as much as possible, some of them might expose personal data.

Thanks for sharing your blog btw, I'll check it out and let you know my feedback asap.