Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
Bicep resource definition
The authenticationPolicies resource type can be deployed with operations that target:
- Resource groups - See resource group deployment commands
For a list of changed properties in each API version, see change log.
Resource format
To create a Microsoft.Network/authenticationPolicies resource, add the following Bicep to your template.
resource symbolicname 'Microsoft.Network/authenticationPolicies@2026-03-01' = {
identity: {
type: 'string'
userAssignedIdentities: {
{customized property}: {}
}
}
location: 'string'
name: 'string'
properties: {
authenticationProperties: {
audience: 'string'
clientId: 'string'
clientSecret: 'string'
issuer: 'string'
jwksUri: 'string'
scope: [
'string'
]
sessionCookieName: 'string'
sessionTimeout: 'string'
}
onUnauthenticatedRequest: 'string'
userTrustProviderType: 'string'
}
tags: {
{customized property}: 'string'
}
}
Property Values
Microsoft.Network/authenticationPolicies
| Name | Description | Value |
|---|---|---|
| identity | The user-assigned identity used by a user sign-in policy to access its Key Vault client secret. | ManagedServiceIdentity |
| location | Resource location. | string |
| name | The resource name | string Constraints: Max length = 80 Pattern = ^[A-Za-z0-9_-]{1,80}$ (required) |
| properties | Properties of the authentication policy. | AuthenticationPolicyPropertiesFormat |
| tags | Resource tags | Dictionary of tag names and values. See Tags in templates |
AuthenticationPolicyPropertiesFormat
| Name | Description | Value |
|---|---|---|
| authenticationProperties | The authentication provider configuration for the policy. | AuthenticationProviderProperties (required) |
| onUnauthenticatedRequest | The action to take when a request is unauthenticated. When omitted, user sign-in policies default to authenticate and JWT validation policies default to deny. |
'allow' 'authenticate' 'deny' |
| userTrustProviderType | The type of the user trust provider. Only Microsoft Entra is supported, using the serialized value entra. |
'entra' (required) |
AuthenticationProviderProperties
| Name | Description | Value |
|---|---|---|
| audience | The intended audience for the JWT. Only a single audience value is supported in this API version. Example: https://audience.com/{application-id} | string Constraints: Max length = 2048 |
| clientId | The Application (client) ID for the related application registered in Microsoft Entra ID, formatted as a GUID. | string Constraints: Pattern = ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$ (required) |
| clientSecret | The absolute HTTPS Key Vault secret URL identifying the client secret used for authentication. This property is required for user sign-in policies. It holds only the Key Vault reference; the secret value itself is never accepted or returned by this API and is read from Key Vault at runtime using the resource's user-assigned identity. The secret value stored in Key Vault can contain up to 4096 characters. Example: https://myvault.vault.azure.net/secrets/mysecret |
string Constraints: Pattern = ^[Hh][Tt][Tt][Pp][Ss]:// |
| issuer | The absolute HTTPS URL of the Secure Token Service. Include a trailing slash at the end of the value. Example: https://login.microsoftonline.com/{Microsoft Entra Tenant ID}/ |
string Constraints: Max length = 2048 Pattern = ^[Hh][Tt][Tt][Pp][Ss]:// (required) |
| jwksUri | The JSON Web Key Set (JWKS) URI used to retrieve the public keys for JWT validation. Example: https://login.microsoftonline.com/{Microsoft Entra Tenant ID}/discovery/v2.0/keys |
string Constraints: Max length = 2048 Pattern = ^[Hh][Tt][Tt][Pp][Ss]:// |
| scope | The scopes used by an application during authentication to authorize access to a user's details. A maximum of 10 scopes is supported, each scope can contain up to 128 characters, and all scopes can contain up to 256 characters combined. | string Constraints: Min length = 1 Max length = 128 Pattern = ^[A-Za-z0-9_.:/-]+$[] |
| sessionCookieName | The name of the session cookie used for user authentication. Applicable to the Application Gateway post-OIDC workflow. | string Constraints: Max length = 256 Pattern = ^[A-Za-z0-9_-]+$ |
| sessionTimeout | The timeout of the session cookie used for user authentication. The service accepts and returns this value as a string containing a base-10 unsigned integer number of seconds with no sign, decimal point, unit suffix, or whitespace (for example 86400). The supported range is 1 to 604800 seconds, and the default is 86400 seconds. Applicable to the Application Gateway post-OIDC workflow. |
string Constraints: Max length = 6 Pattern = ^[1-9][0-9]{0,5}$ |
ManagedServiceIdentity
| Name | Description | Value |
|---|---|---|
| type | The type of identity used for the resource. The type 'SystemAssigned, UserAssigned' includes both an implicitly created identity and a set of user assigned identities. The type 'None' will remove any identities from the virtual machine. | 'None' 'SystemAssigned' 'SystemAssigned, UserAssigned' 'UserAssigned' |
| userAssignedIdentities | The list of user identities associated with resource. The user identity dictionary key references will be ARM resource ids in the form: '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/{identityName}'. | ManagedServiceIdentityUserAssignedIdentities |
ManagedServiceIdentityUserAssignedIdentities
| Name | Description | Value |
|---|
ManagedServiceIdentityUserAssignedIdentities
| Name | Description | Value |
|---|
ResourceTags
| Name | Description | Value |
|---|
ARM template resource definition
The authenticationPolicies resource type can be deployed with operations that target:
- Resource groups - See resource group deployment commands For a list of changed properties in each API version, see change log.
Usage Examples
Resource format
To create a Microsoft.Network/authenticationPolicies resource, add the following JSON to your template.
{
"type": "Microsoft.Network/authenticationPolicies",
"apiVersion": "2026-03-01",
"name": "string",
"identity": {
"type": "string",
"userAssignedIdentities": {
"{customized property}": {
}
}
},
"location": "string",
"properties": {
"authenticationProperties": {
"audience": "string",
"clientId": "string",
"clientSecret": "string",
"issuer": "string",
"jwksUri": "string",
"scope": [ "string" ],
"sessionCookieName": "string",
"sessionTimeout": "string"
},
"onUnauthenticatedRequest": "string",
"userTrustProviderType": "string"
},
"tags": {
"{customized property}": "string"
}
}
Property Values
Microsoft.Network/authenticationPolicies
| Name | Description | Value |
|---|---|---|
| apiVersion | The api version | '2026-03-01' |
| identity | The user-assigned identity used by a user sign-in policy to access its Key Vault client secret. | ManagedServiceIdentity |
| location | Resource location. | string |
| name | The resource name | string Constraints: Max length = 80 Pattern = ^[A-Za-z0-9_-]{1,80}$ (required) |
| properties | Properties of the authentication policy. | AuthenticationPolicyPropertiesFormat |
| tags | Resource tags | Dictionary of tag names and values. See Tags in templates |
| type | The resource type | 'Microsoft.Network/authenticationPolicies' |
AuthenticationPolicyPropertiesFormat
| Name | Description | Value |
|---|---|---|
| authenticationProperties | The authentication provider configuration for the policy. | AuthenticationProviderProperties (required) |
| onUnauthenticatedRequest | The action to take when a request is unauthenticated. When omitted, user sign-in policies default to authenticate and JWT validation policies default to deny. |
'allow' 'authenticate' 'deny' |
| userTrustProviderType | The type of the user trust provider. Only Microsoft Entra is supported, using the serialized value entra. |
'entra' (required) |
AuthenticationProviderProperties
| Name | Description | Value |
|---|---|---|
| audience | The intended audience for the JWT. Only a single audience value is supported in this API version. Example: https://audience.com/{application-id} | string Constraints: Max length = 2048 |
| clientId | The Application (client) ID for the related application registered in Microsoft Entra ID, formatted as a GUID. | string Constraints: Pattern = ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$ (required) |
| clientSecret | The absolute HTTPS Key Vault secret URL identifying the client secret used for authentication. This property is required for user sign-in policies. It holds only the Key Vault reference; the secret value itself is never accepted or returned by this API and is read from Key Vault at runtime using the resource's user-assigned identity. The secret value stored in Key Vault can contain up to 4096 characters. Example: https://myvault.vault.azure.net/secrets/mysecret |
string Constraints: Pattern = ^[Hh][Tt][Tt][Pp][Ss]:// |
| issuer | The absolute HTTPS URL of the Secure Token Service. Include a trailing slash at the end of the value. Example: https://login.microsoftonline.com/{Microsoft Entra Tenant ID}/ |
string Constraints: Max length = 2048 Pattern = ^[Hh][Tt][Tt][Pp][Ss]:// (required) |
| jwksUri | The JSON Web Key Set (JWKS) URI used to retrieve the public keys for JWT validation. Example: https://login.microsoftonline.com/{Microsoft Entra Tenant ID}/discovery/v2.0/keys |
string Constraints: Max length = 2048 Pattern = ^[Hh][Tt][Tt][Pp][Ss]:// |
| scope | The scopes used by an application during authentication to authorize access to a user's details. A maximum of 10 scopes is supported, each scope can contain up to 128 characters, and all scopes can contain up to 256 characters combined. | string Constraints: Min length = 1 Max length = 128 Pattern = ^[A-Za-z0-9_.:/-]+$[] |
| sessionCookieName | The name of the session cookie used for user authentication. Applicable to the Application Gateway post-OIDC workflow. | string Constraints: Max length = 256 Pattern = ^[A-Za-z0-9_-]+$ |
| sessionTimeout | The timeout of the session cookie used for user authentication. The service accepts and returns this value as a string containing a base-10 unsigned integer number of seconds with no sign, decimal point, unit suffix, or whitespace (for example 86400). The supported range is 1 to 604800 seconds, and the default is 86400 seconds. Applicable to the Application Gateway post-OIDC workflow. |
string Constraints: Max length = 6 Pattern = ^[1-9][0-9]{0,5}$ |
ManagedServiceIdentity
| Name | Description | Value |
|---|---|---|
| type | The type of identity used for the resource. The type 'SystemAssigned, UserAssigned' includes both an implicitly created identity and a set of user assigned identities. The type 'None' will remove any identities from the virtual machine. | 'None' 'SystemAssigned' 'SystemAssigned, UserAssigned' 'UserAssigned' |
| userAssignedIdentities | The list of user identities associated with resource. The user identity dictionary key references will be ARM resource ids in the form: '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/{identityName}'. | ManagedServiceIdentityUserAssignedIdentities |
ManagedServiceIdentityUserAssignedIdentities
| Name | Description | Value |
|---|
ManagedServiceIdentityUserAssignedIdentities
| Name | Description | Value |
|---|
ResourceTags
| Name | Description | Value |
|---|
Terraform (AzAPI provider) resource definition
The authenticationPolicies resource type can be deployed with operations that target:
- Resource groups For a list of changed properties in each API version, see change log.
Resource format
To create a Microsoft.Network/authenticationPolicies resource, add the following Terraform to your template.
resource "azapi_resource" "symbolicname" {
type = "Microsoft.Network/authenticationPolicies@2026-03-01"
name = "string"
parent_id = "string"
identity {
type = "string"
identity_ids = [
"string"
]
}
location = "string"
tags = {
{customized property} = "string"
}
body = {
properties = {
authenticationProperties = {
audience = "string"
clientId = "string"
clientSecret = "string"
issuer = "string"
jwksUri = "string"
scope = [
"string"
]
sessionCookieName = "string"
sessionTimeout = "string"
}
onUnauthenticatedRequest = "string"
userTrustProviderType = "string"
}
}
}
Property Values
Microsoft.Network/authenticationPolicies
| Name | Description | Value |
|---|---|---|
| identity | The user-assigned identity used by a user sign-in policy to access its Key Vault client secret. | ManagedServiceIdentity |
| location | Resource location. | string |
| name | The resource name | string Constraints: Max length = 80 Pattern = ^[A-Za-z0-9_-]{1,80}$ (required) |
| properties | Properties of the authentication policy. | AuthenticationPolicyPropertiesFormat |
| tags | Resource tags | Dictionary of tag names and values. |
| type | The resource type | "Microsoft.Network/authenticationPolicies@2026-03-01" |
AuthenticationPolicyPropertiesFormat
| Name | Description | Value |
|---|---|---|
| authenticationProperties | The authentication provider configuration for the policy. | AuthenticationProviderProperties (required) |
| onUnauthenticatedRequest | The action to take when a request is unauthenticated. When omitted, user sign-in policies default to authenticate and JWT validation policies default to deny. |
'allow' 'authenticate' 'deny' |
| userTrustProviderType | The type of the user trust provider. Only Microsoft Entra is supported, using the serialized value entra. |
'entra' (required) |
AuthenticationProviderProperties
| Name | Description | Value |
|---|---|---|
| audience | The intended audience for the JWT. Only a single audience value is supported in this API version. Example: https://audience.com/{application-id} | string Constraints: Max length = 2048 |
| clientId | The Application (client) ID for the related application registered in Microsoft Entra ID, formatted as a GUID. | string Constraints: Pattern = ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$ (required) |
| clientSecret | The absolute HTTPS Key Vault secret URL identifying the client secret used for authentication. This property is required for user sign-in policies. It holds only the Key Vault reference; the secret value itself is never accepted or returned by this API and is read from Key Vault at runtime using the resource's user-assigned identity. The secret value stored in Key Vault can contain up to 4096 characters. Example: https://myvault.vault.azure.net/secrets/mysecret |
string Constraints: Pattern = ^[Hh][Tt][Tt][Pp][Ss]:// |
| issuer | The absolute HTTPS URL of the Secure Token Service. Include a trailing slash at the end of the value. Example: https://login.microsoftonline.com/{Microsoft Entra Tenant ID}/ |
string Constraints: Max length = 2048 Pattern = ^[Hh][Tt][Tt][Pp][Ss]:// (required) |
| jwksUri | The JSON Web Key Set (JWKS) URI used to retrieve the public keys for JWT validation. Example: https://login.microsoftonline.com/{Microsoft Entra Tenant ID}/discovery/v2.0/keys |
string Constraints: Max length = 2048 Pattern = ^[Hh][Tt][Tt][Pp][Ss]:// |
| scope | The scopes used by an application during authentication to authorize access to a user's details. A maximum of 10 scopes is supported, each scope can contain up to 128 characters, and all scopes can contain up to 256 characters combined. | string Constraints: Min length = 1 Max length = 128 Pattern = ^[A-Za-z0-9_.:/-]+$[] |
| sessionCookieName | The name of the session cookie used for user authentication. Applicable to the Application Gateway post-OIDC workflow. | string Constraints: Max length = 256 Pattern = ^[A-Za-z0-9_-]+$ |
| sessionTimeout | The timeout of the session cookie used for user authentication. The service accepts and returns this value as a string containing a base-10 unsigned integer number of seconds with no sign, decimal point, unit suffix, or whitespace (for example 86400). The supported range is 1 to 604800 seconds, and the default is 86400 seconds. Applicable to the Application Gateway post-OIDC workflow. |
string Constraints: Max length = 6 Pattern = ^[1-9][0-9]{0,5}$ |
ManagedServiceIdentity
| Name | Description | Value |
|---|---|---|
| type | The type of identity used for the resource. The type 'SystemAssigned, UserAssigned' includes both an implicitly created identity and a set of user assigned identities. The type 'None' will remove any identities from the virtual machine. | 'None' 'SystemAssigned' 'SystemAssigned, UserAssigned' 'UserAssigned' |
| userAssignedIdentities | The list of user identities associated with resource. The user identity dictionary key references will be ARM resource ids in the form: '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/{identityName}'. | ManagedServiceIdentityUserAssignedIdentities |
ManagedServiceIdentityUserAssignedIdentities
| Name | Description | Value |
|---|
ManagedServiceIdentityUserAssignedIdentities
| Name | Description | Value |
|---|
ResourceTags
| Name | Description | Value |
|---|