ECS 2027

31/05/2027, Congress Center Düsseldorf
Düsseldorf, Germany

SPFx Needs a Backend: Building and Securing Custom APIs with Azure Functions

Your SPFx web part just hit a wall. Maybe you need to call a legacy on-prem system, run heavy computation, or enforce business logic that has no business living in a browser. The SharePoint REST API and Microsoft Graph won't get you there. So what do you build instead? This session walks through building a custom RESTful API in Azure Functions, designed specifically to sit behind an SPFx front end, and doing it right from day one. We'll start with the use cases that actually justify a custom API (not "because it's cool") and move straight into a working Function App. From there we tackle the part most tutorials skip: security. You'll see how to register the app in EntraID, implement the On-Behalf-Of flow so your API runs with the calling user's identity instead of an app-only token (or does both), and validate the incoming JWT properly, no shortcuts. We'll close the loop on the SPFx side too: configuring API permissions, requesting the right scopes, and calling your new endpoint from a web part. By the end you'll have a pattern you can lift straight into your own tenant: an Azure Function that authenticates real users, respects their permissions, and gives your SPFx solutions capabilities the out-of-box APIs simply don't have. You should already be comfortable building SPFx web parts and have basic familiarity with Entra ID app registrations. We won't spend time on SPFx or Azure fundamentals, this session is about the integration between them.