---
title: Creating the JWT-enabled Application Token
slug: kronpam-reference-guide-3-9-0/creating-the-jwt-enabled-application-token
docTags: 
createdAt: 2026-10-10T10:18:10.441Z
---

Navigate to Secrets > Vault > Application Tokens and select Add.

Application Name is a PAM-local label. Choose a descriptive value according to the organization naming policy.

Set Authentication Type to Azure Entra ID and select the Microsoft Entra integration configured in Section 3. In App Client ID, enter the Application (client) ID of the calling App registration. Do not enter either application credential in the Application Token.

Configure Application Network Address Range or Hostname with the source address that PAM sees for the calling application. Select the Vault Account or Vault Group that the application may request, then configure Event User, time limits, usage limits, and allow listing as required.

Names and identifiers visible in the following figure are environment-specific values and must not be copied to another deployment.

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/yTsP-wUrld-b-6FbnZdd4_image.png "Figure – JWT Application Token details")

:::hint{type="info"}
The App Client ID must match the JWT appid or azp claim and therefore must identify the calling application. Do not enter the protected resource Application (client) ID in this field.
:::