AuthenticationProviderProperties interface
Properties for authentication provider configuration. A policy must configure either JWT validation fields or user sign-in fields; the two configurations are mutually exclusive and cannot be combined.
Properties
| audience | The intended audience for the JWT. Only a single audience value is supported in this API version. Example: https://audience.com/{application-id} |
| client |
The Application (client) ID for the related application registered in Microsoft Entra ID, formatted as a GUID. |
| client |
The absolute HTTPS Key Vault secret URL identifying the client secret used for authentication. This property is required for user sign-in policies. It holds only the Key Vault reference; the secret value itself is never accepted or returned by this API and is read from Key Vault at runtime using the resource's user-assigned identity. The secret value stored in Key Vault can contain up to 4096 characters. Example: |
| issuer | The absolute HTTPS URL of the Secure Token Service. Include a trailing slash at the end of the value. Example: |
| jwks |
The JSON Web Key Set (JWKS) URI used to retrieve the public keys for JWT validation. Example: |
| scope | The scopes used by an application during authentication to authorize access to a user's details. A maximum of 10 scopes is supported, each scope can contain up to 128 characters, and all scopes can contain up to 256 characters combined. |
| session |
The name of the session cookie used for user authentication. Applicable to the Application Gateway post-OIDC workflow. |
| session |
The timeout of the session cookie used for user authentication. The service accepts and returns this value as a string containing a base-10 unsigned integer number of seconds with no sign, decimal point, unit suffix, or whitespace (for example |
Property Details
audience
The intended audience for the JWT. Only a single audience value is supported in this API version. Example: https://audience.com/{application-id}
audience?: stringProperty Value
string
clientId
The Application (client) ID for the related application registered in Microsoft Entra ID, formatted as a GUID.
clientId: stringProperty Value
string
clientSecret
The absolute HTTPS Key Vault secret URL identifying the client secret used for authentication. This property is required for user sign-in policies. It holds only the Key Vault reference; the secret value itself is never accepted or returned by this API and is read from Key Vault at runtime using the resource's user-assigned identity. The secret value stored in Key Vault can contain up to 4096 characters. Example: https://myvault.vault.azure.net/secrets/mysecret
clientSecret?: stringProperty Value
string
issuer
The absolute HTTPS URL of the Secure Token Service. Include a trailing slash at the end of the value. Example: https://login.microsoftonline.com/{Microsoft Entra Tenant ID}/
issuer: stringProperty Value
string
jwksUri
The JSON Web Key Set (JWKS) URI used to retrieve the public keys for JWT validation. Example: https://login.microsoftonline.com/{Microsoft Entra Tenant ID}/discovery/v2.0/keys
jwksUri?: stringProperty Value
string
scope
The scopes used by an application during authentication to authorize access to a user's details. A maximum of 10 scopes is supported, each scope can contain up to 128 characters, and all scopes can contain up to 256 characters combined.
scope?: string[]Property Value
string[]
sessionCookieName
The name of the session cookie used for user authentication. Applicable to the Application Gateway post-OIDC workflow.
sessionCookieName?: stringProperty Value
string
sessionTimeout
The timeout of the session cookie used for user authentication. The service accepts and returns this value as a string containing a base-10 unsigned integer number of seconds with no sign, decimal point, unit suffix, or whitespace (for example 86400). The supported range is 1 to 604800 seconds, and the default is 86400 seconds. Applicable to the Application Gateway post-OIDC workflow.
sessionTimeout?: stringProperty Value
string