Step 6 - Corporate authentication

Since the site is static, authentication is configured at the hosting level, not in the code. Choose your platform:

Corporate authentication secrets (AAD_CLIENT_ID, AAD_CLIENT_SECRET, CLOUDFLARE_API_TOKEN, etc.) must be treated as confidential data. Store them in GitHub Secrets (Settings → Secrets and variables → Actions) or manage them through the shared responsibility model used in your organization. Never include them directly in the code or in versioned configuration files.

Azure SWA includes native authentication with Microsoft Entra ID. Create the staticwebapp.config.json file at the project root:

staticwebapp.config.json

{
  "auth": {
    "identityProviders": {
      "azureActiveDirectory": {
        "registration": {
          "openIdIssuer": "https://login.microsoftonline.com/<TENANT_ID>/v2.0",
          "clientIdSettingName": "AAD_CLIENT_ID",
          "clientSecretSettingName": "AAD_CLIENT_SECRET"
        }
      }
    }
  },
  "routes": [
    {
      "route": "/.auth/login/aad",
      "allowedRoles": ["anonymous"]
    },
    {
      "route": "/.auth/*",
      "allowedRoles": ["anonymous"]
    },
    {
      "route": "/*",
      "allowedRoles": ["authenticated"]
    }
  ],
  "responseOverrides": {
    "401": {
      "redirect": "/.auth/login/aad",
      "statusCode": 302
    }
  }
}

Then configure the environment variables in the Azure portal:

AAD_CLIENT_ID → Client ID of your App Registration in Entra ID
AAD_CLIENT_SECRET → Client Secret generated in Entra ID

To restrict access to users in your tenant only, go to "Authentication" in your App Registration and under "Supported account types" select "Accounts in this organizational directory only".