Configure Microsoft Entra ID for agentic IAM

Configure an Azure app registration in Microsoft Entra ID and a Vault OAuth resource server profile to use with Vault Enterprise agentic IAM.

Before you start

• You must have admin access to your Azure tenant.
• You must have permission to create an App registration in Azure.
• You must have curl or some other tool to make API calls.
• You must have jq installed to use the example commands as written.

Step 1: Create an OIDC application in Azure

Create a new App Registration that represents the authentication entry point for your agent.

1. Select App registrations.

   

2. Select New Registration.

3. Name the app vault-oidc.

4. Review the default values for the other fields. In most cases you do not need to change them.

5. Click Register.

Step 2: Create a client secret

Create a client secret in your OIDC applicatopn. Your AI agent uses the client secret to authenticate with Microsoft Entra ID.

1. Select the Certificates & secrets in the Manage section.

2. Select + New client secret.

3. Enter a description and set an appropriate expiration.

4. Click Add.

5. Save the authentication secret name, value, and ID. You need the secret details to integrate with Vault later.

Step 3: Expose an API endpoint for the OIDC application

Generate an application ID URI by exposing an API for the OIDC application. The application ID URI identifies your resource server for scoped token requests.

1. Select Expose an API in the navigation panel.

2. Click Add (next to Application ID URI).

3. Review the default values for the other fields. In most cases you do not need to change them.

4. Click Save.

5. Save the generated Application ID URI. You need the URI to integrate with Vault later.

Step 4: Update the application manifest

Add a requested access token version number to the manifest of your OIDC application so Entra ID issues an access token that Vault can validate.

1. Click Manifest.

2. Add "requestedAccessTokenVersion": 2 to the manifest in the api section:

      ...
      "api": {
         "acceptMappedClaims": null,
         "knownClientApplications": [],
         "requestedAccessTokenVersion": 2,
         "oauth2PermissionScopes": [],
         "preAuthorizedApplications": []
      },
      ... 
   

3. Click Save.

Step 5: Gather your OIDC metadata

Vault needs the following OIDC metadata from your Azure application to configure a Vault OAuth resource server profile:

• The URL that identifies your OIDC application (issuer).
• The JSON web key set (JWKS) URL where clients can download public keys (jwks_uri).
• The token endpoint URL where clients can request OAuth tokens (token_endpoint).

1. Select Overview in the left navigation panel.

2. Select Endpoints.

3. Find the OIDC discovery endpoint in the OpenID Connect metadata document URL field and copy it. Entra discovery endpoints typically have the form: https://login.microsoftonline.com/{tenant_id}/v2.0/.well-known/openid-configuration.

4. Use the discovery endpoint to fetch the metadata document of your dd app :

   $ curl -s <your_open_id_metadata_document_url> | \
     jq -r "{token_endpoint, jwks_uri, issuer}"
   

5. Note the token_endpoint, jwks_uri, and issuer values returned. For example:

   {
      "token_endpoint": "https://login.microsoftonline.com/0000000000000-0000-0000-000000000000/oauth2/v2.0/token",
      "jwks_uri": "https://login.microsoftonline.com/0000000000000-0000-0000-000000000000/discovery/v2.0/keys",
      "issuer": "https://login.microsoftonline.com/0000000000000-0000-0000-000000000000/v2.0",
   }
   

6. Close out the Endpoints page to return to the Overview page.

7. Select your application name next to Managed application in local directory.

   

8. Save the Object ID of your application. You need the object ID to configure Vault later.

   

Step 6: Save your provider information

Confirm your app details from the OpenID Connect metadata document and setup process. To configure Vault agentic IAM, you must have the following information:

We recommend setting the following environment variables to make Vault configuration more convenient:

$ export                                 \
    VAULT_ADDR="<your_vault_server_url>" \
    VAULT_TOKEN="<token_string>"         \
    EXTERNAL_ID="<global_obj_guid>"      \
    APP_ID="<azure_app_uri>"             \
    SECRET_NAME=<app_secret_name>        \
    SECRET_ID=<app_secret_obj_guid>      \
    SECRET_VALUE=<app_secret_string>     \
    TOKEN_ENDPOINT="<token_endpoint>"    \
    JWKS_URI="<jwks_uri>"                \
    ISSUER="<issuer>"

For example:

$ export                                                                                                      \
    VAULT_ADDR="http://127.0.0.1:8200"                                                                        \
    VAULT_TOKEN="hvs.000000000000000000000000"                                                                \
    EXTERNAL_ID="0000000000000-0000-0000-000000000000"                                                        \
    APP_ID="1111111111111-1111-1111-111111111111/2222222222222-2222-2222-222222222222"                        \
    SECRET_NAME="vault-ai-iam"                                                                                \
    SECRET_ID="3333333333333-3333-3333-333333333333"                                                          \
    SECRET_VALUE="AAAAA~xX.XxxXXxx.XxxXxx_XXxxXXxxXXxxX"                                                      \
    TOKEN_ENDPOINT="https://login.microsoftonline.com/0000000000000-0000-0000-000000000000/oauth2/v2.0/token" \
    JWKS_URI="https://login.microsoftonline.com/0000000000000-0000-0000-000000000000/discovery/v2.0/keys"     \
    ISSUER="https://login.microsoftonline.com/0000000000000-0000-0000-000000000000/v2.0"                      \

Next steps

• Configure Vault to secure agentic workflows
• Configure additonal identity provides and authentication servers:
  • Configure IBM Verify for agent IAM
  • Configure Okta for agent IAM
  • Configure Auth0 for agent IAM