GetAccessToken_OnBehalfOfCredential.cs

using Azure.Identity;

public async Task<string> GetAccessTokenAsync(string resourceUrl, string tenantId, string clientId, string clientSecret, string userAssertion, CancellationToken cancellationToken)
{
    // userAssertion is the access token this API received from its caller
    // You can also use a certificate instead of client secret
    var credential = new OnBehalfOfCredential(tenantId, clientId, clientSecret, userAssertion);

    // The passed in cancellation token can be used by the caller to cancel the request
    var accessToken = await credential.GetTokenAsync(new TokenRequestContext(scopes: [resourceUrl + "/.default"]) { }, cancellationToken);

    return accessToken.Token;
}