diff --git a/.changeset/healthy-experts-rhyme.md b/.changeset/healthy-experts-rhyme.md
new file mode 100644
index 0000000000..ca4618f1f5
--- /dev/null
+++ b/.changeset/healthy-experts-rhyme.md
@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-azure-sites-backend': minor
+---
+
+**BREAKING**: The `createRouter` method now requires the `discovery` service to be forwarded from the plugin environment. This is part of the migration to support new auth services.
diff --git a/plugins/azure-sites-backend/api-report.md b/plugins/azure-sites-backend/api-report.md
index 04cd22596a..fa6e8f56c6 100644
--- a/plugins/azure-sites-backend/api-report.md
+++ b/plugins/azure-sites-backend/api-report.md
@@ -3,14 +3,17 @@
 > Do not edit this file. It is a report generated by [API Extractor](https://api-extractor.com/).
 
 ```ts
+import { AuthService } from '@backstage/backend-plugin-api';
 import { AzureSiteListRequest } from '@backstage/plugin-azure-sites-common';
 import { AzureSiteListResponse } from '@backstage/plugin-azure-sites-common';
 import { AzureSiteStartStopRequest } from '@backstage/plugin-azure-sites-common';
 import { CatalogApi } from '@backstage/catalog-client';
 import { Config } from '@backstage/config';
+import { DiscoveryService } from '@backstage/backend-plugin-api';
 import express from 'express';
+import { HttpAuthService } from '@backstage/backend-plugin-api';
 import { Logger } from 'winston';
-import { PermissionEvaluator } from '@backstage/plugin-permission-common';
+import { PermissionsService } from '@backstage/backend-plugin-api';
 
 // @public (undocumented)
 export class AzureSitesApi {
@@ -55,14 +58,20 @@ export function createRouter(options: RouterOptions): Promise<express.Router>;
 
 // @public (undocumented)
 export interface RouterOptions {
+  // (undocumented)
+  auth?: AuthService;
   // (undocumented)
   azureSitesApi: AzureSitesApi;
   // (undocumented)
   catalogApi: CatalogApi;
   // (undocumented)
+  discovery: DiscoveryService;
+  // (undocumented)
+  httpAuth?: HttpAuthService;
+  // (undocumented)
   logger: Logger;
   // (undocumented)
-  permissions: PermissionEvaluator;
+  permissions: PermissionsService;
 }
 
 // (No @packageDocumentation comment for this package)
diff --git a/plugins/azure-sites-backend/package.json b/plugins/azure-sites-backend/package.json
index 2e9a45a33c..fdaf8825ae 100644
--- a/plugins/azure-sites-backend/package.json
+++ b/plugins/azure-sites-backend/package.json
@@ -36,6 +36,7 @@
     "@azure/arm-resourcegraph": "^4.2.1",
     "@azure/identity": "^4.0.0",
     "@backstage/backend-common": "workspace:^",
+    "@backstage/backend-plugin-api": "workspace:^",
     "@backstage/catalog-client": "workspace:^",
     "@backstage/catalog-model": "workspace:^",
     "@backstage/config": "workspace:^",
diff --git a/plugins/azure-sites-backend/src/service/router.ts b/plugins/azure-sites-backend/src/service/router.ts
index bd5d20c05e..79e4f46c04 100644
--- a/plugins/azure-sites-backend/src/service/router.ts
+++ b/plugins/azure-sites-backend/src/service/router.ts
@@ -14,17 +14,16 @@
  * limitations under the License.
  */
 
-import { errorHandler } from '@backstage/backend-common';
+import {
+  createLegacyAuthAdapters,
+  errorHandler,
+} from '@backstage/backend-common';
 import express from 'express';
 import Router from 'express-promise-router';
 import { Logger } from 'winston';
 
 import { InputError, NotAllowedError, NotFoundError } from '@backstage/errors';
-import { getBearerTokenFromAuthorizationHeader } from '@backstage/plugin-auth-node';
-import {
-  PermissionEvaluator,
-  AuthorizeResult,
-} from '@backstage/plugin-permission-common';
+import { AuthorizeResult } from '@backstage/plugin-permission-common';
 import {
   azureSitesActionPermission,
   azureSitesPermissions,
@@ -34,13 +33,22 @@ import { createPermissionIntegrationRouter } from '@backstage/plugin-permission-
 import { CatalogApi } from '@backstage/catalog-client';
 
 import { AzureSitesApi } from '../api';
+import {
+  DiscoveryService,
+  AuthService,
+  HttpAuthService,
+  PermissionsService,
+} from '@backstage/backend-plugin-api';
 
 /** @public */
 export interface RouterOptions {
   logger: Logger;
   azureSitesApi: AzureSitesApi;
   catalogApi: CatalogApi;
-  permissions: PermissionEvaluator;
+  permissions: PermissionsService;
+  discovery: DiscoveryService;
+  auth?: AuthService;
+  httpAuth?: HttpAuthService;
 }
 
 /** @public */
@@ -48,6 +56,7 @@ export async function createRouter(
   options: RouterOptions,
 ): Promise<express.Router> {
   const { logger, azureSitesApi, permissions, catalogApi } = options;
+  const { auth, httpAuth } = createLegacyAuthAdapters(options);
 
   const permissionIntegrationRouter = createPermissionIntegrationRouter({
     permissions: azureSitesPermissions,
@@ -73,13 +82,15 @@ export async function createRouter(
     '/:subscription/:resourceGroup/:name/start',
     async (request, response) => {
       const { subscription, resourceGroup, name } = request.params;
-      const token = getBearerTokenFromAuthorizationHeader(
-        request.header('authorization'),
-      );
+      const credentials = await httpAuth.credentials(request);
       const entityRef = request.body.entityRef;
       if (typeof entityRef !== 'string') {
         throw new InputError('Invalid entityRef, not a string');
       }
+      const { token } = await auth.getPluginRequestToken({
+        onBehalfOf: credentials,
+        targetPluginId: 'catalog',
+      });
       const entity = await catalogApi.getEntityByRef(entityRef, { token });
 
       if (entity) {
@@ -101,9 +112,7 @@ export async function createRouter(
                     resourceRef: entityRef,
                   },
                 ],
-                {
-                  token,
-                },
+                { credentials },
               )
             )[0]
           : undefined;
@@ -130,14 +139,16 @@ export async function createRouter(
     '/:subscription/:resourceGroup/:name/stop',
     async (request, response) => {
       const { subscription, resourceGroup, name } = request.params;
-      const token = getBearerTokenFromAuthorizationHeader(
-        request.header('authorization'),
-      );
+      const credentials = await httpAuth.credentials(request);
 
       const entityRef = request.body.entityRef;
       if (typeof entityRef !== 'string') {
         throw new InputError('Invalid entityRef, not a string');
       }
+      const { token } = await auth.getPluginRequestToken({
+        onBehalfOf: credentials,
+        targetPluginId: 'catalog',
+      });
       const entity = await catalogApi.getEntityByRef(entityRef, { token });
 
       if (entity) {
@@ -160,9 +171,7 @@ export async function createRouter(
                     resourceRef: entityRef,
                   },
                 ],
-                {
-                  token,
-                },
+                { credentials },
               )
             )[0]
           : undefined;
diff --git a/plugins/azure-sites-backend/src/service/standaloneServer.ts b/plugins/azure-sites-backend/src/service/standaloneServer.ts
index 202c1a128d..c0961f0359 100644
--- a/plugins/azure-sites-backend/src/service/standaloneServer.ts
+++ b/plugins/azure-sites-backend/src/service/standaloneServer.ts
@@ -53,6 +53,7 @@ export async function startStandaloneServer(
     permissions,
     azureSitesApi: AzureSitesApi.fromConfig(config),
     catalogApi,
+    discovery,
   });
 
   let service = createServiceBuilder(module)
diff --git a/yarn.lock b/yarn.lock
index 73413df542..83f14f8ca5 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -5000,6 +5000,7 @@ __metadata:
     "@azure/arm-resourcegraph": ^4.2.1
     "@azure/identity": ^4.0.0
     "@backstage/backend-common": "workspace:^"
+    "@backstage/backend-plugin-api": "workspace:^"
     "@backstage/catalog-client": "workspace:^"
     "@backstage/catalog-model": "workspace:^"
     "@backstage/cli": "workspace:^"