Azure Functions + PnP.Core + Managed Identity=💙

$GraphAppId = "00000003-0000-0000-c000-000000000000"  # Microsoft Graph
$SPOAppId = "00000003-0000-0ff1-ce00-000000000000" # SharePoint Online

#Retrieve the Azure AD Service Principal instance for the Microsoft Graph (00000003-0000-0000-c000-000000000000) or SharePoint Online (00000003-0000-0ff1-ce00-000000000000).
$servicePrincipal_Graph = Get-AzureADServicePrincipal -Filter "appId eq '$GraphAppId'"
$servicePrincipal_SPO = Get-AzureADServicePrincipal -Filter "appId eq '$SPOAppId'"

$SPN = Get-AzADServicePrincipal -Filter "displayName eq '$appDisplayName'"
Write-Host "App $appDisplayName created with client id: $($SPN.AppId)"

$permissionName = "Sites.Selected"
$appRole_GraphId = ($servicePrincipal_Graph.AppRoles | Where-Object { $_.AllowedMemberTypes -eq "Application" -and $_.Value -eq $permissionName }).Id
$appRole_SPOId = ($servicePrincipal_SPO.AppRoles | Where-Object { $_.AllowedMemberTypes -eq "Application" -and $_.Value -eq $permissionName }).Id

# Grant API Permissions
New-AzureAdServiceAppRoleAssignment -ObjectId $($SPN.Id) -PrincipalId $($SPN.Id) -ResourceId $($servicePrincipal_Graph.ObjectId) -Id $appRole_GraphId
New-AzureAdServiceAppRoleAssignment -ObjectId $($SPN.Id) -PrincipalId $($SPN.Id) -ResourceId $($servicePrincipal_SPO.ObjectId)   -Id $appRole_SPOId

if ($permission -ne 'FullControl' ) {
    Grant-PnPAzureADAppSitePermission -AppId $appId -DisplayName $appName -Site $siteUrl -Permissions $Permissions
}
else {
    Grant-PnPAzureADAppSitePermission -AppId $appId -DisplayName $appName -Site $siteUrl -Permissions Write
    $PermissionId = Get-PnPAzureADAppSitePermission -AppIdentity $appId
    Set-PnPAzureADAppSitePermission -Site $siteurl -PermissionId $(($PermissionId).Id) -Permissions FullControl
}

public async Task<string> GetAccessTokenAsync(Uri resource, string[] scopes)
{
     //...

     // var credential = new DefaultAzureCredential();
     var credential = new Azure.Identity.ChainedTokenCredential(
          new ManagedIdentityCredential(),
          new EnvironmentCredential()
     );

     var accessToken = await credential.GetTokenAsync(new Azure.Core.TokenRequestContext(scopes));

     return accessToken.Token;
}
//....
private string[] GetRelevantScopes(Uri resourceUri)
{
     if (resourceUri.ToString() == "https://graph.microsoft.com")
     {
          return new[] { $"{resourceUri}" };
     }
     else
     {
          string resource = $"{resourceUri.Scheme}://{resourceUri.DnsSafeHost}";
          return new[] { $"{resource}" };
     }
}

builder.Services.AddPnPCore(options =>
{
     var siteUrl= "https://<tenantname>.sharepoint.com/sites/<siteName>"
     var authProvider = new ManagedIdentityTokenProvider();

     // Set it as default
     options.DefaultAuthenticationProvider = authProvider;

     // Add a default configuration with the site configured in app settings
     options.Sites.Add("Default",
     new PnPCoreSiteOptions
     {
          SiteUrl = siteUrl,
          AuthenticationProvider = authProvider
     });
});

// When MSI is enabled for an App Service, two environment variables MSI_ENDPOINT and MSI_SECRET are available

public bool isMSI = !String.IsNullOrEmpty(Environment.GetEnvironmentVariable("MSI_SECRET"));
//If Managed Identity is configured
if (appConfig.isMSI )
{
     var siteUrl= "https://<tenantname>.sharepoint.com/sites/<siteName>"
     var authProvider = new ManagedIdentityTokenProvider();

     // set it as default
     options.DefaultAuthenticationProvider = authProvider;

     // Add a default configuration with the site configured in app settings
     options.Sites.Add("Default",
          new PnPCoreSiteOptions
          {
               SiteUrl = siteUrl,
               AuthenticationProvider = authProvider
          });
}
else
{
     Console.WriteLine("Local DEV using cert auth");

     var appConfigCert = new AppConfigCert();
     // Configure an authentication provider with certificate (Required for app only)
     // App-only authentication against SharePoint Online requires certificate based authentication for calling the "classic" SharePoint REST/CSOM APIs. The SharePoint Graph calls can work with clientid+secret, but since PnP Core SDK requires both type of APIs (as not all features are exposed via the Graph APIs) you need to use certificate based auth.
     var authProvider = new X509CertificateAuthenticationProvider(...);
     // And set it as default
     options.DefaultAuthenticationProvider = authProvider;

     // Add a default configuration with the site configured in app settings
     options.Sites.Add("Default",
          new PnP.Core.Services.Builder.Configuration.PnPCoreSiteOptions
          {
               SiteUrl = siteUrl,
               AuthenticationProvider = authProvider
          });
     }
});