JWT Request Flow

The calling application first authenticates to Microsoft Entra ID. PAM does not receive the calling application credential.

1.      Request an access token. The calling application sends its own Client ID and credential to the Microsoft Entra ID token endpoint with grant_type=client_credentials and the protected resource scope followed by /.default.

2.      Receive the signed JWT. Microsoft Entra ID returns an access token containing the intended Audience, caller identity, validity period, and assigned application roles.

3.      Call the AAPM password endpoint. The calling application sends the standard AAPM request and adds Authorization: Bearer <jwt>.

4.      Validate the request. PAM verifies the token signature and claims, checks the Application Token policy, resolves the permitted Vault Account, and returns the secret only when every check passes.