Nice article. I'd like only to add that the AzureServiceTokenProvider class from the Microsoft.Azure.Services.AppAuthentication package may be used in such cases. It handles a few authentication methods and allows to easily switch between them without any changes to the code.