// Startup.cs
public void ConfigureServices(IServiceCollection services)
{
    services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
        .AddMicrosoftIdentityWebApi(Configuration.GetSection("AzureAd"));
    
    services.AddControllers();
}

// appsettings.json
{
  "AzureAd": {
    "Instance": "https://login.microsoftonline.com/",
    "TenantId": "your-tenant-id",
    "ClientId": "api-client-id",
    "Audience": "api-client-id"
  }
}

// Controller
[Authorize]
[ApiController]
[Route("[controller]")]
public class SecureController : ControllerBase
{
    [HttpGet]
    public IActionResult Get()
    {
        return Ok("Secure data");
    }
}

// 获取访问令牌
public async Task<string> GetAccessTokenAsync()
{
    var clientId = "client-app-id";
    var clientSecret = "client-secret";
    var tenantId = "tenant-id";
    var scope = "api://api-client-id/.default";
    
    var client = new HttpClient();
    var tokenEndpoint = $"https://login.microsoftonline.com/{tenantId}/oauth2/v2.0/token";
    
    var request = new HttpRequestMessage(HttpMethod.Post, tokenEndpoint);
    var content = new FormUrlEncodedContent(new[]
    {
        new KeyValuePair<string, string>("client_id", clientId),
        new KeyValuePair<string, string>("scope", scope),
        new KeyValuePair<string, string>("client_secret", clientSecret),
        new KeyValuePair<string, string>("grant_type", "client_credentials")
    });
    
    request.Content = content;
    var response = await client.SendAsync(request);
    var responseContent = await response.Content.ReadAsStringAsync();
    var tokenResponse = JsonSerializer.Deserialize<JsonElement>(responseContent);
    return tokenResponse.GetProperty("access_token").GetString();
}

// 调用受保护的API
public async Task<string> CallSecureApiAsync()
{
    var accessToken = await GetAccessTokenAsync();
    var client = new HttpClient();
    client.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", accessToken);
    
    var response = await client.GetAsync("https://yourapi.azurewebsites.net/secure");
    return await response.Content.ReadAsStringAsync();
}