Azure – OpenID Connect setup for App Service through Bicep

After a whole lot of digging througout the night, I found this description how the customopenidconnectprovider should be constructed.

So I ended up with a module containing these bicep resources:

resource existingWebApp 'Microsoft.Web/sites@2022-09-01' existing = {
  name: web_app_name
}

resource config 'Microsoft.Web/sites/config@2023-01-01' = {
  name: 'authsettingsV2'
  parent: existingWebApp
  properties: {
    globalValidation: {
      requireAuthentication: true
      unauthenticatedClientAction: 'Return401'
    }

    identityProviders: {
      customOpenIdConnectProviders: {
        registration: {
          enabled: true
          registration: {
            clientId: client_id
            clientCredential: empty(client_secret_setting_name)
              ? {}
              : {
                  clientSecretSettingName: client_secret_setting_name
                }
            openIdConnectConfiguration: {
              wellKnownOpenIdConfiguration: well_known_openid_configuration
            }
          }
        }
      }
    }
  }
}

I am not sure if this is the best way to do it, but it works for our usage at least.