Microsoft Entra ID issues OIDC tokens for workloads in a tenant. The issuer is https://login.microsoftonline.com/<tenant>/v2.0. The object ID identifies the caller and stays the same if the workload is renamed. You can also require the app registration the token was issued to.
Docs and discovery
| Docs | OpenID Connect on the Microsoft identity platform |
| Issuer | https://login.microsoftonline.com/<tenantId>/v2.0 |
| Discovery | https://login.microsoftonline.com/<tenantId>/v2.0/.well-known/openid-configuration |
Tenant ID is on Entra admin center, Overview. Object ID is the workload's Object (principal) ID.
Token
| Issuer | https://login.microsoftonline.com/<tenantId>/v2.0 |
| Audience | The audience the caller requests, often api://your-app |
| Object ID | oid |
| Client ID | azp, optional |
Tenants such as common are not valid here. IDs are lowercase GUIDs.
Fields
| Field | Claim | Required | Validation |
|---|---|---|---|
| Tenant ID | iss | Yes | GUID. |
| Object ID | oid | Yes | GUID. |
| Application (client) ID | azp | No | GUID if set. |
| Audience | aud | Yes | Often api://your-app. |
| Additional claims | other | No | Cannot reuse aud, oid, or azp. |
Example policy
{
issuer:
"https://login.microsoftonline.com/aaaabbbb-0000-cccc-1111-dddd2222eeee/v2.0",
claims: {
aud: ["api://acme-api"],
oid: ["aaaaaaaa-0000-1111-2222-bbbbbbbbbbbb"],
},
}Add a field
Edit components/oidc/provider-azure.tsx after install. For a one-off claim, use Additional claims. For its own input, add it to Fields (or schema), DEFAULTS, compile, parse, FIRST_CLASS_CLAIMS, and the form.
See Add a field.