Skip to content

Commit d72e2f3

Browse files
prmerger-automator[bot]prmerger-automator[bot]
authored
Merge pull request #284733 from dlepow/vad
[APIM] Update validate-azure-ad-token-policy
2 parents 913335e + 61f044a commit d72e2f3

File tree

1 file changed

+7
-7
lines changed

1 file changed

+7
-7
lines changed

‎articles/api-management/validate-azure-ad-token-policy.md

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ ms.author: danlep
1717
The `validate-azure-ad-token` policy enforces the existence and validity of a JSON web token (JWT) that was provided by the Microsoft Entra (formerly called Azure Active Directory) service for a specified set of principals in the directory. The JWT can be extracted from a specified HTTP header, query parameter, or value provided using a policy expression or context variable.
1818

1919
> [!NOTE]
20-
> To validate a JWT that was provided by another identity provider, API Management also provides the generic [`validate-jwt`](validate-jwt-policy.md) policy.
20+
> To validate a JWT that was provided by an identity provider other than Microsoft Entra, API Management also provides the generic [`validate-jwt`](validate-jwt-policy.md) policy.
2121
2222
[!INCLUDE [api-management-policy-generic-alert](../../includes/api-management-policy-generic-alert.md)]
2323

@@ -26,19 +26,19 @@ The `validate-azure-ad-token` policy enforces the existence and validity of a JS
2626

2727
```xml
2828
<validate-azure-ad-token
29-
tenant-id="tenant ID or URL (for example, "contoso.onmicrosoft.com") of the Azure Active Directory service"
29+
tenant-id="tenant ID or URL (for example, "https://contoso.onmicrosoft.com") of the Microsoft Entra ID tenant"
3030
header-name="name of HTTP header containing the token (alternatively, use query-parameter-name or token-value attribute to specify token)"
3131
query-parameter-name="name of query parameter used to pass the token (alternative, use header-name or token-value attribute to specify token)"
3232
token-value="expression returning the token as a string (alternatively, use header-name or query-parameter attribute to specify token)"
3333
failed-validation-httpcode="HTTP status code to return on failure"
3434
failed-validation-error-message="error message to return on failure"
3535
output-token-variable-name="name of a variable to receive a JWT object representing successfully validated token">
3636
<client-application-ids>
37-
<application-id>Client application ID from Azure Active Directory</application-id>
37+
<application-id>Client application ID from Microsoft Entra</application-id>
3838
<!-- If there are multiple client application IDs, then add additional application-id elements -->
3939
</client-application-ids>
4040
<backend-application-ids>
41-
<application-id>Backend application ID from Azure Active Directory</application-id>
41+
<application-id>Backend application ID from Microsoft Entra</application-id>
4242
<!-- If there are multiple backend application IDs, then add additional application-id elements -->
4343
</backend-application-ids>
4444
<audiences>
@@ -63,7 +63,7 @@ The `validate-azure-ad-token` policy enforces the existence and validity of a JS
6363

6464
| Attribute | Description | Required | Default |
6565
| ------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -------------------------------------------------------------------------------- | --------------------------------------------------------------------------------- |
66-
| tenant-id | Tenant ID or URL of the Microsoft Entra service. Policy expressions are allowed.| Yes | N/A |
66+
| tenant-id | Tenant ID or URL of the Microsoft Entra ID tenant, or one of the following well-known tenants:<br/><br/> - `organizations` or `https://login.microsoftonline.com/organizations` - to allow tokens from accounts in any organizational directory (any Microsoft Entra directory)<br/>- `common` or `https://login.microsoftonline.com/common` - to allow tokens from accounts in any organizational directory (any Microsoft Entra directory) and from personal Microsoft accounts (for example, Skype, XBox)<br/><br/>Policy expressions are allowed.| Yes | N/A |
6767
| header-name | The name of the HTTP header holding the token. Policy expressions are allowed. | One of `header-name`, `query-parameter-name` or `token-value` must be specified. | `Authorization` |
6868
| query-parameter-name | The name of the query parameter holding the token. Policy expressions are allowed. | One of `header-name`, `query-parameter-name` or `token-value` must be specified. | N/A |
6969
| token-value | Expression returning a string containing the token. You must not return `Bearer` as part of the token value. Policy expressions are allowed. | One of `header-name`, `query-parameter-name` or `token-value` must be specified. | N/A |
@@ -121,12 +121,12 @@ The following policy is the minimal form of the `validate-azure-ad-token` policy
121121

122122
### Validate that audience and claim are correct
123123

124-
The following policy checks that the audience is the hostname of the API Management instance and that the `ctry` claim is `US`. The hostname is provided using a policy expression, and the Microsoft Entra tenant ID and client application ID are provided using named values. The decoded JWT is provided in the `jwt` variable after validation.
124+
The following policy checks that the audience is the hostname of the API Management instance and that the `ctry` claim is `US`. The Microsoft tenant ID is the well-known `organizations` tenant, which allows tokens from accounts in any organizational directory. The hostname is provided using a policy expression, and the client application ID is provided using a named value. The decoded JWT is provided in the `jwt` variable after validation.
125125

126126
For more details on optional claims, read [Provide optional claims to your app](../active-directory/develop/active-directory-optional-claims.md).
127127

128128
```xml
129-
<validate-azure-ad-token tenant-id="{{aad-tenant-id}}" output-token-variable-name="jwt">
129+
<validate-azure-ad-token tenant-id="organizations" output-token-variable-name="jwt">
130130
<client-application-ids>
131131
<application-id>{{aad-client-application-id}}</application-id>
132132
</client-application-ids>

0 commit comments

Comments
 (0)