--- schema_version: "1" id: 8ad14e4a96370b707ed9c1704b7842de7aa89b91dc2022169a9cd4d53533874e title: Configuring Microsoft Entra ID Client Management in Anypoint Platform collection: mulesoft version: current locale: en-us portal_url: https://docs.salesforce.com/mulesoft/current/en-us/access-management/configure-client-management-entra-id.md canonical_url: https://docs.mulesoft.com/access-management/configure-client-management-entra-id source_site: docs.mulesoft.com content_type: documentation content_hash: cfbf0fa2bdcc5afd1ba9695ac0daebe98fe5343ebeb0692db475d512eebcdda1 description: MuleSoft Documentation Site latest: true --- --- product: Access Management version: master --- # Configuring Microsoft Entra ID Client Management in Anypoint Platform > For the full documentation index, see: https://docs.mulesoft.com/llms.txt Authenticate and authorize API consumers by using Microsoft Entra ID (formerly Azure AD) as a client provider in Anypoint Platform. Use dynamic client registration to configure Microsoft Entra ID client management and convert OAuth 2.0 client application registration requests to requests supported by Microsoft Entra ID. > [!NOTE] You can’t configure Microsoft Entra ID (formerly Azure AD) as a client provider in > MuleSoft Government Cloud. ## Configure the Client Provider Set up the OpenID Connect Dynamic Client Registration provider for Microsoft Entra ID in Access Management. > [!NOTE] Anypoint Platform doesn’t support Microsoft Azure client providers deployed in Microsoft > national clouds, such as Azure Government or Azure China 21Vianet. 1. Sign in to Anypoint Platform using an account that has the Organization Administrator permission. 2. Select **Access Management** from the ![gear icon](/mulesoft/current/en-us/access-management/_images/gear.svg) menu. 3. In the Access Management navigation menu, click **Client Providers**. 4. Click **Add Client Provider**, and then select **OpenID Connect DCR for Microsoft Entra ID (Azure AD)**. The **Add OIDC Microsoft Entra ID (Azure AD) client provider** page appears. 5. Enter a name and description for your client provider. 6. Enter the values from your identity provider’s configuration: 1. **Issuer**: URL that the OpenID provider asserts is its trusted issuer. 2. **Tenant ID for Microsoft Entra ID**: The tenant ID from Microsoft Entra ID. For more information on obtaining your tenant ID, see [How to find your Microsoft Entra tenant ID](https://learn.microsoft.com/en-us/entra/fundamentals/how-to-find-tenant). 3. **Client ID**: The client ID for an existing client in your identity provider (IdP) that is capable of creating applications in Microsoft Entra ID. 4. **Client Secret**: The client secret that corresponds to the client ID. 5. **Client Secret Expiration Duration**: Duration the application secret is valid for. 180 days is the recommended value and is used by default if you don’t make a selection. The configured expiration duration persists through secret resets and client provider updates. 7. Expand the **Advanced Settings** section. These selections are optional: 1. **Disable server certificate validation**: Disables server certificate validation if your Microsoft Entra ID client management instance presents a self-signed certificate, or one signed by an internal certificate authority. 2. **Enable client deletion in Anypoint Platform**: Enables the deletion of clients created with this integration. 3. **Enable client deletion and updates in IdP**: To use this option, you must also select the **Enable client deletion in Anypoint Platform** option. This option enables you to update and delete external clients in the configured IdP through an outbound call made by Microsoft Entra ID to `[https://graph.microsoft.com/v1.0/applications/{clientId}](https://graph.microsoft.com/v1.0/applications/{clientId})`. For an example of the `PATCH` payload, see the [Update application](https://learn.microsoft.com/en-us/graph/api/application-update?view=graph-rest-1.0&tabs=http) documentation. For an example of the `DELETE` payload, see the [Delete application](https://learn.microsoft.com/en-us/graph/api/application-delete?view=graph-rest-1.0&tabs=http) documentation. 8. Click **Create**. > [!NOTE] To make sure your client management integration remains stable and supported, avoid making > manual edits to the application directly within the Azure portal. > > Modifying the application in Azure can interfere with operational flows managed by Anypoint > Platform, such as client updates and secret resets. If you encounter issues, verify that no manual > changes were made to the application in the Azure portal. ## Service Principals When you register a client application, Anypoint Platform also creates a [service principal](https://learn.microsoft.com/en-us/entra/identity-platform/app-objects-and-service-principals) (enterprise application) for that application in Microsoft Entra ID. The service principal is the identity Microsoft Entra ID uses to represent the application in your tenant. Service principal creation is best-effort. If service principal creation fails, Anypoint Platform still creates and returns the client application, so client registration isn’t blocked. The registration response includes a `service_principal_status` field that reports the outcome, which is one of `created`, `failed`, `skipped`, or `disabled`. ## Supported OAuth 2.0 Features Anypoint Platform provides support for Microsoft Identity Platform access tokens, Microsoft Entra ID v2.0 endpoints, grant types, and client secrets. ### Access Tokens For your APIs, Microsoft Entra ID client management in Anypoint Platform supports both [v1 and v2 JSON Web Tokens](https://learn.microsoft.com/en-us/entra/identity-platform/access-tokens) (JWTs) on Microsoft identity platform. ### OAuth 2.0 Endpoints Anypoint Platform supports only tokens obtained using Microsoft Entra ID v2.0 endpoints, also known as Microsoft identity platform endpoints. For example, Anypoint Platform supports the token endpoint: `[https://login.microsoftonline.com/{tenantId}/oauth2/v2.0/token](https://login.microsoftonline.com/{tenantId}/oauth2/v2.0/token)`. Use these properties when you’re using the Authorization Code grant type to obtain a token: - `authorize url`: `[https://login.microsoftonline.com/{tenantId}/oauth2/v2.0/authorize](https://login.microsoftonline.com/{tenantId}/oauth2/v2.0/authorize)` - `token url`: `[https://login.microsoftonline.com/{tenantId}/oauth2/v2.0/token](https://login.microsoftonline.com/{tenantId}/oauth2/v2.0/token)` - `client id`: {your client id} - `client secret`: {your client secret} - `scope`: `[https://graph.microsoft.com/.default](https://graph.microsoft.com/.default)` Anypoint Platform doesn’t support custom scopes. Use the default scope for Microsoft Graph. ### Grant Types For a list of supported OAuth 2.0 authorization code grant types, see the [Microsoft identity platform documentation](https://learn.microsoft.com/en-us/entra/identity-platform/v2-oauth2-auth-code-flow). When [creating a new application with Microsoft](https://learn.microsoft.com/en-us/graph/api/application-post-applications?view=graph-rest-1.0&tabs=http), you can’t specify the supported OAuth 2.0 authorization code grant types. Because of this limitation on the Microsoft Entra ID side, Anypoint Platform doesn’t support selecting grant types. ### Client Secrets Client secrets (application passwords) use a string value in the Microsoft Entra ID application for authentication instead of a certificate for identity. Client secrets are set to expire six months from the date of creation, following Microsoft’s security recommendations. You can customize the expiration date when [configuring the client provider](#config-client-provider). You can create new client secrets in Anypoint Platform, but you must delete old or expired client secrets directly in your Microsoft account portal. Remove expired secrets promptly. ### Token Introspection Microsoft Entra ID doesn’t provide an introspection endpoint out of the box, but Anypoint Platform has a [policy that implements token introspection for you](https://docs.mulesoft.com/mule-gateway/policies-included-openid-token-enforcement#token-validation-endpoint-authentication) when you configure Microsoft Entra ID as a client provider following the previous flow. When you create your client provider following the OpenID Connect DCR for Microsoft Entra ID flow, Anypoint Platform populates an introspect URL. You can view the URL using `GET /accounts/api/organizations/{orgId}/clientProviders/{clientProviderId}`. During token introspection, Anypoint Platform calls `[https://graph.microsoft.com/v1.0](https://graph.microsoft.com/v1.0)` with your provided token. As long as the response to such a call isn’t a failure, the token is determined to be valid. > [!NOTE] Use the token enforcement policy implementation version 1.7 and later so that during token > introspection, Anypoint Platform calls > `[https://graph.microsoft.com/v1.0](https://graph.microsoft.com/v1.0)` directly, bypassing the > internal Anypoint Platform component. To use this policy, follow the documentation on [OAuth 2.0 Endpoints](#oauth2) to generate supported tokens. #### Token Validation Fails When you try to enforce the OpenID Connect (OIDC) policy by invoking an Anypoint API using a valid token obtained from Microsoft Entra ID and get a `Token has been revoked` error, refer to [OAuth 2.0 Endpoints](#oauth2) to confirm that you obtained the token using a supported method. If the token validation still fails, contact Support. ## See Also - [How to find your Microsoft Entra ID tenant ID](https://learn.microsoft.com/en-us/entra/fundamentals/how-to-find-tenant) - [Microsoft identity platform access tokens](https://learn.microsoft.com/en-us/entra/identity-platform/access-tokens) - [Microsoft National Clouds](https://learn.microsoft.com/en-us/entra/identity-platform/authentication-national-cloud)