The Two Application Identities
Two separate Microsoft Entra ID application identities are required: one identity represents PAM (the protected resource application), and the other identity represents the workload that calls PAM (the calling application).
Each identity has its own App registration, which stores the identity definition (Client ID, credentials, and application roles), and its own Enterprise application, which is the tenant-local object that permission and role assignments apply to.
The two identities are never interchangeable. Their Client IDs and credentials belong to different applications.
The following table maps each identity to the value it produces and to the PAM field where that value is entered.
Identity | Produces this value | Configured in PAM |
|---|---|---|
Protected resource (represents PAM) | Tenant ID | System Configuration Manager > Integrations > Microsoft Entra ID > Tenant ID |
Client ID and Client Secret | System Configuration Manager > Integrations > Microsoft Entra ID > Client ID / Client Secret | |
Application ID URI | System Configuration Manager > Integrations > Microsoft Entra ID > PAM API Application ID URI / Audience | |
Calling application (represents the workload) | Client ID | Secrets > Vault > Application Tokens > Add > App Client ID |
Client Secret | Stored only in the workload. Never entered in PAM. | |
Assigned application role(s) | Secrets > Vault > Application Tokens > Save Options > Required Role |
