Web App (Linux): Outbound connections failing with authentication error

Problem description

I am experiencing issues with outbound connections from my Linux-based web application. The connections are failing when attempting to access Microsoft Graph, specifically when requesting security scores. The error encountered is an HTTP 400 with AADSTS500011 during the request to 'https://graph.microsoft.com/v1.0/security/secureScores'. This problem persists only in the Azure-hosted environment, while local tests using PowerShell succeed.

Environment

Web App (Linux), Azure App Service, Region not specified

What I've already tried

I reviewed the case details and diagnostic information. The application uses Axios with OAuth 2.0 client credentials to obtain Microsoft Graph tokens. I confirmed that the application uses the correct tenant ID and Microsoft Graph audience, and no proxy environment variables are set. I reproduced the issue directly from Azure App Service SSH using native Node.js fetch, bypassing application code and Axios, observing the same failure. I also compared token claims from local and Azure environments, finding they match. Local PowerShell requests succeed, but Azure requests fail with the specific error referencing an internal Microsoft Defender resource.

Current status

I am seeking assistance to investigate why the Azure-hosted environment encounters this specific authentication error when accessing Microsoft Graph, despite identical credentials and environment configurations. I would appreciate guidance on further troubleshooting steps or insights into potential environment-specific issues affecting token acquisition or request routing.