Configuring the Microsoft Entra ID Integration in PAM
Navigate to Administration > System Configuration Manager > Integrations > Microsoft Entra ID and create a new integration.
Integration Name is a PAM-local label. Choose a name that follows the organization naming policy.
Enter Tenant ID from the Microsoft Entra tenant. Enter Client ID, Client Secret, and PAM API Application ID URI / Audience from the protected resource App registration. These three values must belong to the same registration.
Do not enter the calling application Client ID or credential in this screen. User Groups to import and Users to import are unrelated to JWT authentication and are needed only when the same integration is also used for directory import.
Names and identifiers visible in the following figure are environment-specific values. Use the values from the target Microsoft Entra tenant.
PAM derives the issuer and OpenID Connect metadata from the Tenant ID. It obtains the JWKS signing-key endpoint from the metadata rather than requiring an administrator to enter issuer or JWKS values separately.
PAM caches Microsoft Entra ID signing keys. When a token uses an unknown key ID, PAM refreshes the keys to handle Microsoft key rotation without contacting Entra ID for every request.