Pod workload identity vs app registration (enterprise app) identity

[drilko]

Hello,
I'm not sure if I'm failing to understand some concept but I'm gonna try to explain what issue I have.

• I have a .NET Api (Api A) and an angular client application and another .NET API (API B)
• Both APIs are using ClientId from App registrations which I created under out tenant
• Client application is consuming API A with scope api://api-a-client-id/some-scope-name
• API A is consuming API B with scope api://api-b-client-id/.default (I've created an app role for API B and added API A to it)
• Both APIs are deployed to an AKS environment
• Locally, I'm using API A's client secret created under app registration to authenticate to API B - this works fine
• In AKS environment I'm trying to use workload identity to authenticate to API B (so I don't have to deal with client secrets)
  • I've created a managed identity which represents API A's identity in AKS environment (https://learn.microsoft.com/en-us/azure/aks/learn/tutorial-kubernetes-workload-identity)
  • I've added the identity to an API B enterprise application role which I created previously (https://learn.microsoft.com/en-us/entra/identity/managed-identities-azure-resources/how-to-assign-app-role-managed-identity-cli)
  • the problem here is that in AKS environment it fails to retrieve an access token because client id I'm using there is that of an app registration instead of managed identity client id
  • if I set it to managed identity client id, API A manages to authenticate to API B but now client application calls fails because of different client id and the fact that managed identity can't expose a scope as app registration can

Also I've tried to do this but it gets ignored and uses ClientId set in "AzureAd" section anyways:

.EnableTokenAcquisitionToCallDownstreamApi(options =>
{
    azureAdSection.Bind(options);
    options.ClientId = "my-workload-identity-client-id";
})

I'm not sure if I'm failing to understand something crucial but please help me understand this.