Microsoft Entra ID On-Behalf-Of Flow

Overview

The On-Behalf-Of (OBO) flow lets a middle-tier API call downstream APIs using delegated user identity from Microsoft Entra ID.

OBO Flow

sequenceDiagram
    participant User
    participant Frontend
    participant APIA
    participant EntraID
    participant APIB
    User->>Frontend: Sign in
    Frontend->>APIA: Access token for API A
    APIA->>EntraID: Exchange token (OBO)
    EntraID-->>APIA: Access token for API B
    APIA->>APIB: Call with delegated token

Practical Example

API A validates incoming token, requests downstream token with required scopes, then calls API B with least-privilege permissions.

Production Example

Enterprise platforms use OBO to preserve user context across API chains while enforcing tenant and scope boundaries.

Common Pitfalls

• Requesting excessive downstream scopes
• Missing token cache strategy
• Confusing app-only and delegated permission models

Key Takeaways

• OBO enables secure delegated access between APIs.
• Scope design and token validation are critical.
• Delegated flows should preserve least privilege end to end.