Using the same audience for multiple services with Entra ID

Question

Hello,

With keycloak as OIDC provider we used to define a global audience and use it within all our services to verify the intended recipients of the token . However, with Azure AD this aud claim seems to be unconfigurable.

My question is: Is there any way to configure multiple App Registrations to define the same audience?

Thank you.

Answer 1

Hi @Mocanu, Radu ,

If you are referring to having one service principal with multiple app registrations, this scenario is supported. You can have multiple app registrations for one app service, and you can support one application service using multiple authentication schemas. Microsoft Identity Platform supports multiple authentication schemas which allow users to sign into an application either with two App registrations or one Entra ID/Azure AD app and another B2C app.

See example here and modifications for v2 here.

However, if you want to set up multiple service principals with different client IDs, this scenario is not supported. Every service principal/enterprise application in other tenants has the same client id as the corresponding app in the home tenant. But there cannot be more than one service principal with the same client id in one tenant.

Let me know if the examples I shared cover the scenario you are looking for.