I am trying to secure my SPA application against obtaining API keys for not authorized users. First of all, I have created Azure Maps in portal and assigned registration app from Azure Active Directory to be an owner for all Azure Maps actions. After that, I achieved token from C# client using AzureTokenServiceProvider class:

    var azureServiceTokenProvider = new AzureServiceTokenProvider("RunAs=App;AppId={AppId};TenantId={TenantId};AppKey={AppKey}");
    var token = await azureServiceTokenProvider.GetAccessTokenAsync("https://atlas.microsoft.com");

Token obtained from server was used to client-side rendered map:

{
   "authOptions":{
      "authType": AuthenticationType.anonymous,
      "clientId":"{clientId}",
      "getToken": (resolve) => resolve('ey...') 
   }
}

Map using this authentication type is not rendering, because in network tab there is an response with 403 status code with body:

"Provided principal ID '{...}' was NotAllowed access with Azure Role Based Access Control. Confirm access at {...}. "target": "Microsoft.Maps/accounts/services/render/read"".

I'm not sure if my configuration is correct, but I thought that access token achieved for registration app related with Azure Maps should be enough for render map this way.

What should I do to generate token which might be used in getToken method in client-side?

Thanks in advance for any answer.