Microsoft.ContainerService managedClusters/jwtAuthenticators

Bicep resource definition

The managedClusters/jwtAuthenticators resource type can be deployed with operations that target:

For a list of changed properties in each API version, see change log.

Resource format

To create a Microsoft.ContainerService/managedClusters/jwtAuthenticators resource, add the following Bicep to your template.

resource symbolicname 'Microsoft.ContainerService/managedClusters/jwtAuthenticators@2026-06-02-preview' = {
  parent: resourceSymbolicName
  name: 'string'
  properties: {
    certificateAuthorityBundle: 'string'
    claimMappings: {
      extra: [
        {
          key: 'string'
          valueExpression: 'string'
        }
      ]
      groups: {
        expression: 'string'
      }
      uid: {
        expression: 'string'
      }
      username: {
        expression: 'string'
      }
    }
    claimValidationRules: [
      {
        expression: 'string'
        message: 'string'
      }
    ]
    issuer: {
      audiences: [
        'string'
      ]
      url: 'string'
    }
    userValidationRules: [
      {
        expression: 'string'
        message: 'string'
      }
    ]
  }
}

Property Values

Microsoft.ContainerService/managedClusters/jwtAuthenticators

Name Description Value
name The resource name string

Constraints:
Min length = 1
Max length = 24
Pattern = ^[a-z][a-z0-9]{0,23}$ (required)
parent In Bicep, you can specify the parent resource for a child resource. You only need to add this property when the child resource is declared outside of the parent resource.

For more information, see Child resource outside parent resource.		 Symbolic name for resource of type: managedClusters
properties The properties of JWTAuthenticator. For details on how to configure the properties of a JWT authenticator, please refer to the Kubernetes documentation: https://kubernetes.io/docs/reference/access-authn-authz/authentication/#using-authentication-configuration. Please note that not all fields available in the Kubernetes documentation are supported by AKS. For troubleshooting, please see https://aka.ms/aks-external-issuers-docs. JWTAuthenticatorProperties (required)

JWTAuthenticatorClaimMappingExpression

Name Description Value
expression The CEL expression used to access token claims. string (required)

JWTAuthenticatorClaimMappings

Name Description Value
extra The expression to extract extra attribute from the token claims. When not provided, no extra attributes are extracted from the token claims. JWTAuthenticatorExtraClaimMappingExpression[]
groups The expression to extract groups attribute from the token claims. When not provided, no groups are extracted from the token claims. JWTAuthenticatorClaimMappingExpression
uid The expression to extract uid attribute from the token claims. When not provided, no uid is extracted from the token claims. JWTAuthenticatorClaimMappingExpression
username The expression to extract username attribute from the token claims. JWTAuthenticatorClaimMappingExpression (required)

JWTAuthenticatorExtraClaimMappingExpression

Name Description Value
key The key of the extra attribute. string (required)
valueExpression The CEL expression used to extract the value of the extra attribute. string (required)

JWTAuthenticatorIssuer

Name Description Value
audiences The set of acceptable audiences the JWT must be issued to. At least one is required. When multiple is set, AudienceMatchPolicy is used in API Server configuration. string[] (required)
url The issuer URL. The URL must begin with the scheme https and cannot contain a query string or fragment. This must match the "iss" claim in the presented JWT, and the issuer returned from discovery. string (required)

JWTAuthenticatorProperties

Name Description Value
certificateAuthorityBundle PEM-encoded CA certificate bundle used to validate the connection when fetching discovery information. Use this for issuer endpoints that use private certificate authorities
or environments where TLS inspection is performed.

The bundle must contain only CERTIFICATE PEM blocks, up to 10 CA certificates, and must be no larger than 20 KB in total. Include all CA certificates needed to validate
the issuer endpoint's TLS certificate. Certificate revocation checking is not supported.

If provided, only these CAs are trusted instead of the well-known root CAs.
If not provided and the managed cluster's properties.securityProfile.customCATrustCertificates is set, those certificates will be used instead. Otherwise, only the well-known
root CAs are trusted.		 string
claimMappings The mappings that define how user attributes are extracted from the token claims. JWTAuthenticatorClaimMappings (required)
claimValidationRules The rules that are applied to validate token claims to authenticate users. All the expressions must evaluate to true for validation to succeed. JWTAuthenticatorValidationRule[]
issuer The JWT OIDC issuer details. JWTAuthenticatorIssuer (required)
userValidationRules The rules that are applied to the mapped user before completing authentication. All the expressions must evaluate to true for validation to succeed. JWTAuthenticatorValidationRule[]

JWTAuthenticatorValidationRule

Name Description Value
expression The CEL expression used to validate the claim or attribute. string (required)
message The validation error message. string

ARM template resource definition

The managedClusters/jwtAuthenticators resource type can be deployed with operations that target:

Usage Examples

Resource format

To create a Microsoft.ContainerService/managedClusters/jwtAuthenticators resource, add the following JSON to your template.

{
  "type": "Microsoft.ContainerService/managedClusters/jwtAuthenticators",
  "apiVersion": "2026-06-02-preview",
  "name": "string",
  "properties": {
    "certificateAuthorityBundle": "string",
    "claimMappings": {
      "extra": [
        {
          "key": "string",
          "valueExpression": "string"
        }
      ],
      "groups": {
        "expression": "string"
      },
      "uid": {
        "expression": "string"
      },
      "username": {
        "expression": "string"
      }
    },
    "claimValidationRules": [
      {
        "expression": "string",
        "message": "string"
      }
    ],
    "issuer": {
      "audiences": [ "string" ],
      "url": "string"
    },
    "userValidationRules": [
      {
        "expression": "string",
        "message": "string"
      }
    ]
  }
}

Property Values

Microsoft.ContainerService/managedClusters/jwtAuthenticators

Name Description Value
apiVersion The api version '2026-06-02-preview'
name The resource name string

Constraints:
Min length = 1
Max length = 24
Pattern = ^[a-z][a-z0-9]{0,23}$ (required)
properties The properties of JWTAuthenticator. For details on how to configure the properties of a JWT authenticator, please refer to the Kubernetes documentation: https://kubernetes.io/docs/reference/access-authn-authz/authentication/#using-authentication-configuration. Please note that not all fields available in the Kubernetes documentation are supported by AKS. For troubleshooting, please see https://aka.ms/aks-external-issuers-docs. JWTAuthenticatorProperties (required)
type The resource type 'Microsoft.ContainerService/managedClusters/jwtAuthenticators'

JWTAuthenticatorClaimMappingExpression

Name Description Value
expression The CEL expression used to access token claims. string (required)

JWTAuthenticatorClaimMappings

Name Description Value
extra The expression to extract extra attribute from the token claims. When not provided, no extra attributes are extracted from the token claims. JWTAuthenticatorExtraClaimMappingExpression[]
groups The expression to extract groups attribute from the token claims. When not provided, no groups are extracted from the token claims. JWTAuthenticatorClaimMappingExpression
uid The expression to extract uid attribute from the token claims. When not provided, no uid is extracted from the token claims. JWTAuthenticatorClaimMappingExpression
username The expression to extract username attribute from the token claims. JWTAuthenticatorClaimMappingExpression (required)

JWTAuthenticatorExtraClaimMappingExpression

Name Description Value
key The key of the extra attribute. string (required)
valueExpression The CEL expression used to extract the value of the extra attribute. string (required)

JWTAuthenticatorIssuer

Name Description Value
audiences The set of acceptable audiences the JWT must be issued to. At least one is required. When multiple is set, AudienceMatchPolicy is used in API Server configuration. string[] (required)
url The issuer URL. The URL must begin with the scheme https and cannot contain a query string or fragment. This must match the "iss" claim in the presented JWT, and the issuer returned from discovery. string (required)

JWTAuthenticatorProperties

Name Description Value
certificateAuthorityBundle PEM-encoded CA certificate bundle used to validate the connection when fetching discovery information. Use this for issuer endpoints that use private certificate authorities
or environments where TLS inspection is performed.

The bundle must contain only CERTIFICATE PEM blocks, up to 10 CA certificates, and must be no larger than 20 KB in total. Include all CA certificates needed to validate
the issuer endpoint's TLS certificate. Certificate revocation checking is not supported.

If provided, only these CAs are trusted instead of the well-known root CAs.
If not provided and the managed cluster's properties.securityProfile.customCATrustCertificates is set, those certificates will be used instead. Otherwise, only the well-known
root CAs are trusted.		 string
claimMappings The mappings that define how user attributes are extracted from the token claims. JWTAuthenticatorClaimMappings (required)
claimValidationRules The rules that are applied to validate token claims to authenticate users. All the expressions must evaluate to true for validation to succeed. JWTAuthenticatorValidationRule[]
issuer The JWT OIDC issuer details. JWTAuthenticatorIssuer (required)
userValidationRules The rules that are applied to the mapped user before completing authentication. All the expressions must evaluate to true for validation to succeed. JWTAuthenticatorValidationRule[]

JWTAuthenticatorValidationRule

Name Description Value
expression The CEL expression used to validate the claim or attribute. string (required)
message The validation error message. string

Terraform (AzAPI provider) resource definition

The managedClusters/jwtAuthenticators resource type can be deployed with operations that target:

  • Resource groups For a list of changed properties in each API version, see change log.

Resource format

To create a Microsoft.ContainerService/managedClusters/jwtAuthenticators resource, add the following Terraform to your template.

resource "azapi_resource" "symbolicname" {
  type = "Microsoft.ContainerService/managedClusters/jwtAuthenticators@2026-06-02-preview"
  name = "string"
  parent_id = "string"
  body = {
    properties = {
      certificateAuthorityBundle = "string"
      claimMappings = {
        extra = [
          {
            key = "string"
            valueExpression = "string"
          }
        ]
        groups = {
          expression = "string"
        }
        uid = {
          expression = "string"
        }
        username = {
          expression = "string"
        }
      }
      claimValidationRules = [
        {
          expression = "string"
          message = "string"
        }
      ]
      issuer = {
        audiences = [
          "string"
        ]
        url = "string"
      }
      userValidationRules = [
        {
          expression = "string"
          message = "string"
        }
      ]
    }
  }
}

Property Values

Microsoft.ContainerService/managedClusters/jwtAuthenticators

Name Description Value
name The resource name string

Constraints:
Min length = 1
Max length = 24
Pattern = ^[a-z][a-z0-9]{0,23}$ (required)
parent_id The ID of the resource that is the parent for this resource. ID for resource of type: managedClusters
properties The properties of JWTAuthenticator. For details on how to configure the properties of a JWT authenticator, please refer to the Kubernetes documentation: https://kubernetes.io/docs/reference/access-authn-authz/authentication/#using-authentication-configuration. Please note that not all fields available in the Kubernetes documentation are supported by AKS. For troubleshooting, please see https://aka.ms/aks-external-issuers-docs. JWTAuthenticatorProperties (required)
type The resource type "Microsoft.ContainerService/managedClusters/jwtAuthenticators@2026-06-02-preview"

JWTAuthenticatorClaimMappingExpression

Name Description Value
expression The CEL expression used to access token claims. string (required)

JWTAuthenticatorClaimMappings

Name Description Value
extra The expression to extract extra attribute from the token claims. When not provided, no extra attributes are extracted from the token claims. JWTAuthenticatorExtraClaimMappingExpression[]
groups The expression to extract groups attribute from the token claims. When not provided, no groups are extracted from the token claims. JWTAuthenticatorClaimMappingExpression
uid The expression to extract uid attribute from the token claims. When not provided, no uid is extracted from the token claims. JWTAuthenticatorClaimMappingExpression
username The expression to extract username attribute from the token claims. JWTAuthenticatorClaimMappingExpression (required)

JWTAuthenticatorExtraClaimMappingExpression

Name Description Value
key The key of the extra attribute. string (required)
valueExpression The CEL expression used to extract the value of the extra attribute. string (required)

JWTAuthenticatorIssuer

Name Description Value
audiences The set of acceptable audiences the JWT must be issued to. At least one is required. When multiple is set, AudienceMatchPolicy is used in API Server configuration. string[] (required)
url The issuer URL. The URL must begin with the scheme https and cannot contain a query string or fragment. This must match the "iss" claim in the presented JWT, and the issuer returned from discovery. string (required)

JWTAuthenticatorProperties

Name Description Value
certificateAuthorityBundle PEM-encoded CA certificate bundle used to validate the connection when fetching discovery information. Use this for issuer endpoints that use private certificate authorities
or environments where TLS inspection is performed.

The bundle must contain only CERTIFICATE PEM blocks, up to 10 CA certificates, and must be no larger than 20 KB in total. Include all CA certificates needed to validate
the issuer endpoint's TLS certificate. Certificate revocation checking is not supported.

If provided, only these CAs are trusted instead of the well-known root CAs.
If not provided and the managed cluster's properties.securityProfile.customCATrustCertificates is set, those certificates will be used instead. Otherwise, only the well-known
root CAs are trusted.		 string
claimMappings The mappings that define how user attributes are extracted from the token claims. JWTAuthenticatorClaimMappings (required)
claimValidationRules The rules that are applied to validate token claims to authenticate users. All the expressions must evaluate to true for validation to succeed. JWTAuthenticatorValidationRule[]
issuer The JWT OIDC issuer details. JWTAuthenticatorIssuer (required)
userValidationRules The rules that are applied to the mapped user before completing authentication. All the expressions must evaluate to true for validation to succeed. JWTAuthenticatorValidationRule[]

JWTAuthenticatorValidationRule

Name Description Value
expression The CEL expression used to validate the claim or attribute. string (required)
message The validation error message. string
  • Last updated on