Is there a way to programmatically configure azure EasyAuth for AAD for an Azure Function App?

Question

I am writing Azure CLI scripts to automate creating cloud-side components in Microsoft Azure. In particular, I am using the CLI to create Azure Function Apps. However, while I am able to create a Function App using the CLI, I have not been able to identify a way to configure authentication against Azure Active Directory, other than by using the Azure Portal user interface (see https://learn.microsoft.com/en-us/azure/app-service/configure-authentication-provider-aad for a description of the interactive process).

It's clear that the interactive process performs several steps behind the scenes, including creating an AAD Application registration and associating the registration with the Function App. My questions are:

1. What are details of the steps performed?
2. Is there a programmatic way, either with the CLI or some other interface, to perform the same set of steps?

Answer 1

Easy Auth is actually a module on IIS. You can enable it using Azure CLI:

az webapp auth update  -g myResourceGroup -n myUniqueApp --enabled true \
  --action LoginWithAzureActiveDirectory \
  --aad-allowed-token-audiences https://webapp_name.azurewebsites.net/.auth/login/aad/callback \
  --aad-client-id ecbacb08-df8b-450d-82b3-3fced03f2b27 --aad-client-secret very_secret_password \
  --aad-token-issuer-url https://sts.windows.net/54826b22-38d6-4fb2-bad9-b7983a3e9c5a/

https://learn.microsoft.com/en-us/cli/azure/webapp/auth?view=azure-cli-latest#az_webapp_auth