I am implementing single sign on with Azure Active Directory. The front end is in Angular and back end is in .net core WebApi.
I saw and example that you have to create two AAd apps one for front end and one for back end why we have to create two apps?
The main reason you define two apps is so that you can acquire and use an access token with the API. Without that, you could only use an Id token, which should not be used for authorization in an API. An Id token is only meant for the client that triggered the login. When calling an API, you should use an access token for that API.
