Open API Tool Managed Identity doesn't work with scope containing api://

[anoop7181]

We have Azure AD application which has api scope in the format of api://xxxx.com.
The Open API spec tool Managed Identity audience doesn't accept it and only accepts the URI in https:// format.

It accepts the value in POST body using REST API but the tool call errors during runtime in playground.

The work around is to change the scope which is bigger change for existing applications and integrations.

Please Provide support for Open API spec tool Managed Identity to accept audience with format of api://

[nicholasdbrady]

Hey @anoop7181!

Thank you for raising this important question about support for api:// audience URIs in the OpenAPI Managed Identity tooling. It's clear you’ve run into a subtle but impactful aspect of Azure AD and API integration standards, and you’re not alone—many developers are
experiencing similar roadblocks as the platform evolves.

What’s Happening

• Audience Format (aud claim): Microsoft Entra ID (formerly Azure AD) officially supports both api://{AppId} and https://{domain}/... formats for the Application ID URI, which is used as the audience for tokens to an API. You'll see this documented in:
  • Security best practices for application properties in Microsoft Entra ID
  • Validating the audience in claims
• Tooling Support Gap: While both formats are valid at the identity platform and in tokens, not all Azure tools and sample integrations (including some OpenAPI Managed Identity and playground environments) properly accept api:// as the audience for managed identity flows,
  even if it’s allowed in REST APIs. Some tools still expect or enforce the legacy https:// format.
  • The Azure AI Foundry OpenAPI tooling docs provide only https:// audience examples (see: How to use the OpenAPI spec tool (portal)).

Options and Current Workarounds

• Your current workaround (changing the scope/audience to https://...) is disruptive and not always feasible for established apps.
• You might continue to use the REST API where api:// works or look for updates in the relevant SDK or tool’s changelogs to see if support for api:// has been added.
• Application ID URI format and compatibility guidance may offer additional context for app architects.

Feature Request Status

• This is a known gap in the ecosystem; ideally all Azure tooling would support both api:// and https:// audience formats.
• For now, the cleanest path is to continue using the REST API with the POST workaround, or, if critical, consider escalating through Azure Support or opening an issue on the relevant SDK/tooling GitHub repo for visibility.

---

Thank you again for highlighting this! If you find these references helpful, please let us know or mark the answer as accepted.

With gratitude,
@nicholasdbrady