# Secure a Mobile API in 5 Steps

> In order. The order is most of the value.

- **Format:** short video, 8 steps, ~25 seconds
- **Topic:** The five layers that secure a mobile API on Azure, added in order — HTTPS only, authentication with Microsoft Entra ID, authorization, secrets in Key Vault with a managed identity, and monitoring with Application Insights and Defender for Cloud.
- **Author:** Suthahar Jegatheesan (MSDEVBUILD)
- **Category:** Azure · Azure Security
- **Published:** 2026-08-23
- **Tags:** azure, apisecurity, dotnet, aspnetcore, security, microsoftentraid, azurekeyvault, backenddeveloper, cloudsecurity, devsecops, mobiledeveloper, webdevelopment, microsoftazure, msdevbuild
- **Canonical URL:** https://blog.msdevbuild.com/shorts/secure-mobile-api-five-steps/

---
## What you'll learn

- The five layers a mobile API needs, and what each one actually stops
- Why authentication and authorization are two separate steps, not one
- Why monitoring is last but is the step you will be glad you did

## Understand it one step at a time

### 1. A public URL and nothing else

Your API answers on a plain URL. No auth, no TLS requirement, no monitoring — anyone on earth can call it right now.

### 2. Step 1: HTTPS only

Turn off plain HTTP entirely — not a redirect that still accepts it first, off. Everything before this step travels in the clear.

### 3. Step 2: who are you?

Microsoft Entra ID validates the token’s signature and audience. No valid token, the request never reaches your code.

### 4. Step 3: what may you see?

A different question from step 2. Her token is genuinely valid — your API still has to filter every query by her own id.

### 5. Step 4: no secrets in config

Key Vault holds every secret; a managed identity fetches them at runtime. No connection string, no password, anywhere in config.

### 6. Step 5: watch it

Application Insights and Defender for Cloud watch every call — so a scan against you shows up as an alert, not silence.

### 7. Now try it without a token

Take away the token and call again. The request dies at step 2 — and step 5 is what tells you it happened at all.

### 8. The order is the point

You can do step 5 last and lose nothing. You cannot do step 1 last — every step before it just travelled unencrypted.

---

## The takeaway

**Five layers. One API. In this order.**

HTTPS, authentication, authorization, secrets, monitoring — each answers a different question.