Preparing Microsoft Entra ID

In the Microsoft Entra admin center, navigate to Identity > Applications > App registrations. Create a new registration or select an existing registration that is reserved for representing the PAM password API. Choose its display name according to the organization naming policy, PAM does not read or validate this name.

1.      Open Expose an API and define the Application ID URI. This URI becomes the expected JWT Audience. Record both the Application (client) ID and Application ID URI.

2.      Open App roles and create the application roles that calling applications may receive. Set Allowed member types to Applications. Each role value must exactly match the value later entered in the PAM Required Role field.

3.      Open Certificates & secrets and create the credential used by the PAM Microsoft Entra integration. Record the secret value when it is created because Microsoft Entra ID does not show the value again.

1.      Create or select a second App registration for the service, agent, script, or application that will request passwords from PAM. This calling application must remain separate from the protected resource application.

2.      Create a credential for the calling application. Keep this credential only in the calling application's protected configuration. It is used to request an access token and is never entered in PAM.

3.      In Microsoft Entra ID, navigate to Identity > Applications > Enterprise applications and open the Enterprise application that belongs to the protected resource application.

4.      Open Users and groups, select Add user/group, change the selection type to Applications, select the calling application's Enterprise application, select the required application role, and complete the assignment. Repeat the assignment for every required role.

Request an access token from Microsoft Entra ID before configuring PAM. Use the calling application Client ID and credential, and request the protected resource Application ID URI followed by /.default.

·   Confirm that the token Audience identifies the protected resource application.

·   Confirm that appid for a v1 token or azp for a v2 token identifies the calling application.

·   Confirm that the roles claim contains every application role required by the PAM Application Token.