Create the app registration that represents the Claude API audience. changedmanage-claude/wif-providers/azure
Nearest release: v2.1.302, published 12 hours after this site recorded the change. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Recorded here
Lines+196added
Lines−131removed
From line
141
where the diff opens
First seen
14 Aug 2026
this site's first read of the page
Recorded edits12to this page, all time
The whole hunk
from line 141, old and new numbered
/
from line 141
141141
142142### Acquire and use the token
143143
144At runtime your workload fetches its Entra token, exchanges it at `POST /v1/oauth/token`, and uses the returned bearer token to call Claude. The Claude SDK handles the exchange and refresh loop when you supply `identity_token_provider` (typescript, php: `identityTokenProvider`; csharp: `IdentityTokenProvider`; go: `option.WithFederationTokenProvider`; java: `federationTokenProvider`), as shown in the following examples. The cURL tab shows the raw flow.
144At runtime your workload fetches its Entra token, exchanges it at `POST /v1/oauth/token`, and uses the returned bearer token to call Claude. The Claude SDK handles the exchange and refresh loop when you supply `identity_token_provider` (typescript: `identityTokenProvider`; php: `identityProvider`; csharp: `IdentityTokenProvider`; go: `option.WithFederationTokenProvider`; java: `IdentityTokenConfig`), as shown in the following examples. Except in Java (see the comment in that example), that option takes a token provider, and the SDK calls it again for each refresh. The cURL tab shows the raw flow.
145145
146146The samples fetch the managed identity token from the platform's token endpoint: IMDS on VMs and VM Scale Sets, or the `IDENTITY_ENDPOINT` service on App Service, Functions, and Container Apps. Replace `<APP_ID>` in the `api://<APP_ID>` resource value with the audience app registration's client ID from [Register the token audience](https://platform.claude.com/docs/en/manage-claude/wif-providers/azure#register-the-token-audience).
147147
148148<Tip>
149 If your workload already uses the Azure Identity client library, pass its token acquisition (`DefaultAzureCredential` with the scope `api://<APP_ID>/.default`) to `identity_token_provider` (typescript, php: `identityTokenProvider`; csharp: `IdentityTokenProvider`; go: `option.WithFederationTokenProvider`; java: `federationTokenProvider`) instead of calling the token endpoints directly. The library selects the correct endpoint on every Azure platform, including AKS with Entra Workload Identity.
149 If your workload already uses the Azure Identity client library, get the Entra token from it (`DefaultAzureCredential` with the scope `api://<APP_ID>/.default`) instead of calling the token endpoints directly. Supply it to `identity_token_provider` (typescript: `identityTokenProvider`; php: `identityProvider`; csharp: `IdentityTokenProvider`; go: `option.WithFederationTokenProvider`; java: `IdentityTokenConfig`) the way the examples do. The library selects the correct endpoint on every Azure platform, including AKS with Entra Workload Identity.
150150</Tip>
151151
152152<CodeGroup>
from line 374
374374 ```
375375
376376 ```java Java
377 HttpClient http = HttpClient.newHttpClient();
378 // The audience app registration's identifier URI (see Register the token audience).
379 String audience = "api://<APP_ID>";
380 // App Service, Functions, and Container Apps inject IDENTITY_ENDPOINT;
381 // VMs and VM Scale Sets use IMDS.
382 // With multiple user-assigned identities, append &client_id=<IDENTITY_CLIENT_ID>.
383 String identityEndpoint = System.getenv("IDENTITY_ENDPOINT");
384 HttpRequest tokenRequest = identityEndpoint != null
385 ? HttpRequest.newBuilder(URI.create(identityEndpoint + "?api-version=2019-08-01&resource=" + audience))
386 .header("X-IDENTITY-HEADER", System.getenv("IDENTITY_HEADER"))
387 .build()
388 : HttpRequest.newBuilder(URI.create("http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=" + audience))
389 .header("Metadata", "true")
390 .build();
377 import com.anthropic.config.AuthenticationConfig;
378 import com.anthropic.config.AuthenticationType;
379 import com.anthropic.config.IdentityTokenConfig;
380 import com.anthropic.config.InMemoryProfileConfigProvider;
381 import com.anthropic.config.ProfileConfig;
382 // ...
383 import com.fasterxml.jackson.databind.ObjectMapper;
384 import java.net.URI;
385 import java.net.http.HttpClient;
386 import java.net.http.HttpRequest;
387 import java.net.http.HttpResponse;
391388
392 IdentityTokenProvider fetchEntraToken = () -> {
393 try {
394 var response = http.send(tokenRequest, HttpResponse.BodyHandlers.ofString());
395 return new ObjectMapper().readTree(response.body()).get("access_token").asText();
396 } catch (Exception e) {
397 throw new RuntimeException(e);
398 }
399 };
389 void main() throws Exception {
390 HttpClient http = HttpClient.newHttpClient();
391 // The audience app registration's identifier URI (see Register the token audience).
392 String audience = "api://<APP_ID>";
393 // App Service, Functions, and Container Apps inject IDENTITY_ENDPOINT;
394 // VMs and VM Scale Sets use IMDS.
395 // With multiple user-assigned identities, append &client_id=<IDENTITY_CLIENT_ID>.
396 String identityEndpoint = System.getenv("IDENTITY_ENDPOINT");
397 HttpRequest tokenRequest = identityEndpoint != null
398 ? HttpRequest.newBuilder(URI.create(identityEndpoint + "?api-version=2019-08-01&resource=" + audience))
399 .header("X-IDENTITY-HEADER", System.getenv("IDENTITY_HEADER"))
400 .build()
401 : HttpRequest.newBuilder(URI.create("http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=" + audience))
402 .header("Metadata", "true")
403 .build();
400404
401 AnthropicClient client = AnthropicOkHttpClient.builder()
402 .federationTokenProvider(
403 fetchEntraToken,
404 System.getenv("ANTHROPIC_FEDERATION_RULE_ID"),
405 System.getenv("ANTHROPIC_ORGANIZATION_ID"),
406 System.getenv("ANTHROPIC_SERVICE_ACCOUNT_ID"),
407 System.getenv("ANTHROPIC_WORKSPACE_ID"))
408 .build();
405 // The Java SDK takes the token itself or a file path, not a function; with
406 // source("value"), path(...) holds the token. The SDK sends that same token
407 // at every refresh of the Anthropic access token, which fails once it has
408 // expired or, if it has a jti claim, been used. For a longer-running
409 // process, pass source("file") and write a new token to the file before
410 // each refresh.
411 var response = http.send(tokenRequest, HttpResponse.BodyHandlers.ofString());
412 String entraToken = new ObjectMapper().readTree(response.body()).get("access_token").asText();
409413
410 var message = client.messages().create(MessageCreateParams.builder()
411 .model(Model.CLAUDE_OPUS_5_5)
412 .maxTokens(1024)
413 .addUserMessage("Hello from Azure")
414 .build());
414 AnthropicClient client = AnthropicOkHttpClient.builder()
415 .configurationProvider(InMemoryProfileConfigProvider.of(ProfileConfig.builder()
416 .organizationId(System.getenv("ANTHROPIC_ORGANIZATION_ID"))
417 .workspaceId(System.getenv("ANTHROPIC_WORKSPACE_ID"))
418 .authentication(AuthenticationConfig.builder()
419 .type(AuthenticationType.OIDC_FEDERATION)
420 .federationRuleId(System.getenv("ANTHROPIC_FEDERATION_RULE_ID"))
421 .serviceAccountId(System.getenv("ANTHROPIC_SERVICE_ACCOUNT_ID"))
422 .identityToken(IdentityTokenConfig.builder()
423 .source("value")
424 .path(entraToken)
425 .build())
426 .build())
427 .build()))
428 .build();
415429
416 IO.println(message.content());
430 var message = client.messages().create(MessageCreateParams.builder()
431 .model(Model.CLAUDE_OPUS_5_5)
432 .maxTokens(1024)
433 .addUserMessage("Hello from Azure")
434 .build());
435
436 IO.println(message.content());
437 }
417438 ```
418439
419440 ```csharp C#
from line 500
479500
480501 ```php PHP
481502 use Anthropic\Client;
482 use Anthropic\Credentials\WorkloadIdentityCredentials;
503 use Anthropic\Lib\Credentials\CredentialResult;
504 use Anthropic\Lib\Credentials\IdentityTokenProvider;
505 use Anthropic\Lib\Credentials\TokenCache;
506 use Anthropic\Lib\Credentials\WorkloadIdentityCredentials;
483507
484508 // The audience app registration's identifier URI (see Register the token audience).
485509 const AUDIENCE = 'api://<APP_ID>';
486510
487 function fetchEntraToken(): string
511 class EntraIdentityToken implements IdentityTokenProvider
488512 {
489 // App Service, Functions, and Container Apps inject IDENTITY_ENDPOINT;
490 // VMs and VM Scale Sets use IMDS.
491 // With multiple user-assigned identities, append &client_id=<IDENTITY_CLIENT_ID>.
492 $identityEndpoint = getenv('IDENTITY_ENDPOINT');
493 if ($identityEndpoint !== false) {
494 $url = $identityEndpoint . '?api-version=2019-08-01&resource=' . AUDIENCE;
495 $header = 'X-IDENTITY-HEADER: ' . getenv('IDENTITY_HEADER');
496 } else {
497 $url = 'http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=' . AUDIENCE;
498 $header = 'Metadata: true';
513 public function getIdentityToken(): string
514 {
515 // App Service, Functions, and Container Apps inject IDENTITY_ENDPOINT;
516 // VMs and VM Scale Sets use IMDS.
517 // With multiple user-assigned identities, append &client_id=<IDENTITY_CLIENT_ID>.
518 $identityEndpoint = getenv('IDENTITY_ENDPOINT');
519 if ($identityEndpoint !== false) {
520 $url = $identityEndpoint . '?api-version=2019-08-01&resource=' . AUDIENCE;
521 $header = 'X-IDENTITY-HEADER: ' . getenv('IDENTITY_HEADER');
522 } else {
523 $url = 'http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=' . AUDIENCE;
524 $header = 'Metadata: true';
525 }
526 $context = stream_context_create([
527 'http' => ['header' => $header . "\r\n"],
528 ]);
529 $body = json_decode(file_get_contents($url, false, $context), true);
530 return $body['access_token'];
499531 }
500 $context = stream_context_create([
501 'http' => ['header' => $header . "\r\n"],
502 ]);
503 $body = json_decode(file_get_contents($url, false, $context), true);
504 return $body['access_token'];
505532 }
506533
507 $credentials = new WorkloadIdentityCredentials(
508 identityTokenProvider: fetchEntraToken(...),
509 federationRuleId: getenv('ANTHROPIC_FEDERATION_RULE_ID'),
510 organizationId: getenv('ANTHROPIC_ORGANIZATION_ID'),
511 serviceAccountId: getenv('ANTHROPIC_SERVICE_ACCOUNT_ID'),
512 workspaceId: getenv('ANTHROPIC_WORKSPACE_ID') ?: null,
534 $credentials = new CredentialResult(
535 provider: new TokenCache(new WorkloadIdentityCredentials(
536 identityProvider: new EntraIdentityToken(),
537 federationRuleId: getenv('ANTHROPIC_FEDERATION_RULE_ID'),
538 organizationId: getenv('ANTHROPIC_ORGANIZATION_ID'),
539 serviceAccountId: getenv('ANTHROPIC_SERVICE_ACCOUNT_ID'),
540 workspaceId: getenv('ANTHROPIC_WORKSPACE_ID') ?: null,
541 )),
513542 );
514543 $client = new Client(credentials: $credentials);
515544
from line 790
761790
762791### Acquire and use the token
763792
764At runtime the pod performs the two-hop exchange: it sends the Kubernetes-projected token (the file at `AZURE_FEDERATED_TOKEN_FILE`) to Entra's token endpoint as a federated `client_credentials` assertion, then exchanges the resulting Entra access token at `POST /v1/oauth/token`. The Claude SDK handles the second exchange and the refresh loop when you pass the Entra fetch to `identity_token_provider` (typescript, php: `identityTokenProvider`; csharp: `IdentityTokenProvider`; go: `option.WithFederationTokenProvider`; java: `federationTokenProvider`), as shown in the following examples. The cURL tab shows the raw flow.
793At runtime the pod performs the two-hop exchange: it sends the Kubernetes-projected token (the file at `AZURE_FEDERATED_TOKEN_FILE`) to Entra's token endpoint as a federated `client_credentials` assertion, then exchanges the resulting Entra access token at `POST /v1/oauth/token`. The Claude SDK handles the second exchange and the refresh loop when you supply `identity_token_provider` (typescript: `identityTokenProvider`; php: `identityProvider`; csharp: `IdentityTokenProvider`; go: `option.WithFederationTokenProvider`; java: `IdentityTokenConfig`), as shown in the following examples. Except in Java (see the comment in that example), that option takes your Entra fetch as a token provider, and the SDK calls it again for each refresh. The cURL tab shows the raw flow.
765794
766795Two different client IDs appear in the samples. `<APP_ID>` is the audience app registration's client ID from [Register the token audience](https://platform.claude.com/docs/en/manage-claude/wif-providers/azure#register-the-token-audience); the scope `api://<APP_ID>/.default` asks Entra for a token addressed to that audience. `$AZURE_CLIENT_ID` is the managed identity's client ID, injected by the webhook, and identifies the caller. Do not substitute one for the other.
767796
768797<Tip>
769 If your workload already uses the Azure Identity client library, pass its token acquisition (`DefaultAzureCredential` with the scope `api://<APP_ID>/.default`) to `identity_token_provider` (typescript, php: `identityTokenProvider`; csharp: `IdentityTokenProvider`; go: `option.WithFederationTokenProvider`; java: `federationTokenProvider`) instead of performing the two-hop exchange yourself. The library reads the same `AZURE_FEDERATED_TOKEN_FILE`, `AZURE_CLIENT_ID`, and `AZURE_TENANT_ID` environment variables and handles the Entra exchange.
798 If your workload already uses the Azure Identity client library, get the Entra token from it (`DefaultAzureCredential` with the scope `api://<APP_ID>/.default`) instead of performing the two-hop exchange yourself. Supply it to `identity_token_provider` (typescript: `identityTokenProvider`; php: `identityProvider`; csharp: `IdentityTokenProvider`; go: `option.WithFederationTokenProvider`; java: `IdentityTokenConfig`) the way the examples do. The library reads the same `AZURE_FEDERATED_TOKEN_FILE`, `AZURE_CLIENT_ID`, and `AZURE_TENANT_ID` environment variables and handles the Entra exchange.
770799</Tip>
771800
772801<CodeGroup>
from line 1007
9781007 ```
9791008
9801009 ```java Java
981 IdentityTokenProvider fetchEntraTokenViaFederation = () -> {
982 try {
983 var form = Map.of(
984 "client_id", System.getenv("AZURE_CLIENT_ID"),
985 "grant_type", "client_credentials",
986 "scope", "api://<APP_ID>/.default",
987 "client_assertion_type", "urn:ietf:params:oauth:client-assertion-type:jwt-bearer",
988 "client_assertion", Files.readString(Path.of(System.getenv("AZURE_FEDERATED_TOKEN_FILE"))))
989 .entrySet().stream()
990 .map(entry -> entry.getKey() + "=" + URLEncoder.encode(entry.getValue(), UTF_8))
991 .collect(Collectors.joining("&"));
992 var request = HttpRequest.newBuilder(URI.create(
993 "https://login.microsoftonline.com/" + System.getenv("AZURE_TENANT_ID") + "/oauth2/v2.0/token"))
994 .header("content-type", "application/x-www-form-urlencoded")
995 .POST(HttpRequest.BodyPublishers.ofString(form))
996 .build();
997 var response = HttpClient.newHttpClient().send(request, HttpResponse.BodyHandlers.ofString());
998 return new ObjectMapper().readTree(response.body()).get("access_token").asText();
999 } catch (Exception e) {
1000 throw new RuntimeException(e);
1001 }
1002 };
1010 import com.anthropic.config.AuthenticationConfig;
1011 import com.anthropic.config.AuthenticationType;
1012 import com.anthropic.config.IdentityTokenConfig;
1013 import com.anthropic.config.InMemoryProfileConfigProvider;
1014 import com.anthropic.config.ProfileConfig;
1015 // ...
1016 import com.fasterxml.jackson.databind.ObjectMapper;
1017 import java.net.URI;
1018 import java.net.URLEncoder;
1019 import java.net.http.HttpClient;
1020 import java.net.http.HttpRequest;
1021 import java.net.http.HttpResponse;
1022 import java.nio.file.Files;
1023 import java.nio.file.Path;
1024 import java.util.Map;
1025 import java.util.stream.Collectors;
1026 import static java.nio.charset.StandardCharsets.UTF_8;
10031027
1004 AnthropicClient client = AnthropicOkHttpClient.builder()
1005 .federationTokenProvider(
1006 fetchEntraTokenViaFederation,
1007 System.getenv("ANTHROPIC_FEDERATION_RULE_ID"),
1008 System.getenv("ANTHROPIC_ORGANIZATION_ID"),
1009 System.getenv("ANTHROPIC_SERVICE_ACCOUNT_ID"),
1010 System.getenv("ANTHROPIC_WORKSPACE_ID"))
1011 .build();
1028 void main() throws Exception {
1029 var form = Map.of(
1030 "client_id", System.getenv("AZURE_CLIENT_ID"),
1031 "grant_type", "client_credentials",
1032 "scope", "api://<APP_ID>/.default",
1033 "client_assertion_type", "urn:ietf:params:oauth:client-assertion-type:jwt-bearer",
1034 "client_assertion", Files.readString(Path.of(System.getenv("AZURE_FEDERATED_TOKEN_FILE"))))
1035 .entrySet().stream()
1036 .map(entry -> entry.getKey() + "=" + URLEncoder.encode(entry.getValue(), UTF_8))
1037 .collect(Collectors.joining("&"));
1038 var request = HttpRequest.newBuilder(URI.create(
1039 "https://login.microsoftonline.com/" + System.getenv("AZURE_TENANT_ID") + "/oauth2/v2.0/token"))
1040 .header("content-type", "application/x-www-form-urlencoded")
1041 .POST(HttpRequest.BodyPublishers.ofString(form))
1042 .build();
10121043
1013 var message = client.messages().create(MessageCreateParams.builder()
1014 .model(Model.CLAUDE_OPUS_5_5)
1015 .maxTokens(1024)
1016 .addUserMessage("Hello from Azure")
1017 .build());
1044 // The Java SDK takes the token itself or a file path, not a function; with
1045 // source("value"), path(...) holds the token. The SDK sends that same token
1046 // at every refresh of the Anthropic access token, which fails once it has
1047 // expired or, if it has a jti claim, been used. For a longer-running
1048 // process, pass source("file") and write a new token to the file before
1049 // each refresh.
1050 var response = HttpClient.newHttpClient().send(request, HttpResponse.BodyHandlers.ofString());
1051 String entraToken = new ObjectMapper().readTree(response.body()).get("access_token").asText();
10181052
1019 IO.println(message.content());
1053 AnthropicClient client = AnthropicOkHttpClient.builder()
1054 .configurationProvider(InMemoryProfileConfigProvider.of(ProfileConfig.builder()
1055 .organizationId(System.getenv("ANTHROPIC_ORGANIZATION_ID"))
1056 .workspaceId(System.getenv("ANTHROPIC_WORKSPACE_ID"))
1057 .authentication(AuthenticationConfig.builder()
1058 .type(AuthenticationType.OIDC_FEDERATION)
1059 .federationRuleId(System.getenv("ANTHROPIC_FEDERATION_RULE_ID"))
1060 .serviceAccountId(System.getenv("ANTHROPIC_SERVICE_ACCOUNT_ID"))
1061 .identityToken(IdentityTokenConfig.builder()
1062 .source("value")
1063 .path(entraToken)
1064 .build())
1065 .build())
1066 .build()))
1067 .build();
1068
1069 var message = client.messages().create(MessageCreateParams.builder()
1070 .model(Model.CLAUDE_OPUS_5_5)
1071 .maxTokens(1024)
1072 .addUserMessage("Hello from Azure")
1073 .build());
1074
1075 IO.println(message.content());
1076 }
10201077 ```
10211078
10221079 ```csharp C#
from line 1133
10761133
10771134 ```php PHP
10781135 use Anthropic\Client;
1079 use Anthropic\Credentials\WorkloadIdentityCredentials;
1136 use Anthropic\Lib\Credentials\CredentialResult;
1137 use Anthropic\Lib\Credentials\IdentityTokenProvider;
1138 use Anthropic\Lib\Credentials\TokenCache;
1139 use Anthropic\Lib\Credentials\WorkloadIdentityCredentials;
10801140
1081 function fetchEntraTokenViaFederation(): string
1141 class EntraIdentityTokenViaFederation implements IdentityTokenProvider
10821142 {
1083 $ch = curl_init('https://login.microsoftonline.com/' . getenv('AZURE_TENANT_ID') . '/oauth2/v2.0/token');
1084 curl_setopt_array($ch, [
1085 CURLOPT_RETURNTRANSFER => true,
1086 CURLOPT_POSTFIELDS => http_build_query([
1087 'client_id' => getenv('AZURE_CLIENT_ID'),
1088 'grant_type' => 'client_credentials',
1089 'scope' => 'api://<APP_ID>/.default',
1090 'client_assertion_type' => 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer',
1091 'client_assertion' => file_get_contents(getenv('AZURE_FEDERATED_TOKEN_FILE')),
1092 ]),
1093 ]);
1094 $body = json_decode(curl_exec($ch), true);
1095 curl_close($ch);
1096 return $body['access_token'];
1143 public function getIdentityToken(): string
1144 {
1145 $ch = curl_init('https://login.microsoftonline.com/' . getenv('AZURE_TENANT_ID') . '/oauth2/v2.0/token');
1146 curl_setopt_array($ch, [
1147 CURLOPT_RETURNTRANSFER => true,
1148 CURLOPT_POSTFIELDS => http_build_query([
1149 'client_id' => getenv('AZURE_CLIENT_ID'),
1150 'grant_type' => 'client_credentials',
1151 'scope' => 'api://<APP_ID>/.default',
1152 'client_assertion_type' => 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer',
1153 'client_assertion' => file_get_contents(getenv('AZURE_FEDERATED_TOKEN_FILE')),
1154 ]),
1155 ]);
1156 $body = json_decode(curl_exec($ch), true);
1157 curl_close($ch);
1158 return $body['access_token'];
1159 }
10971160 }
10981161
10991162 $client = new Client(
1100 credentials: new WorkloadIdentityCredentials(
1101 identityTokenProvider: fetchEntraTokenViaFederation(...),
1102 federationRuleId: getenv('ANTHROPIC_FEDERATION_RULE_ID'),
1103 organizationId: getenv('ANTHROPIC_ORGANIZATION_ID'),
1104 serviceAccountId: getenv('ANTHROPIC_SERVICE_ACCOUNT_ID'),
1105 workspaceId: getenv('ANTHROPIC_WORKSPACE_ID') ?: null,
1163 credentials: new CredentialResult(
1164 provider: new TokenCache(new WorkloadIdentityCredentials(
1165 identityProvider: new EntraIdentityTokenViaFederation(),
1166 federationRuleId: getenv('ANTHROPIC_FEDERATION_RULE_ID'),
1167 organizationId: getenv('ANTHROPIC_ORGANIZATION_ID'),
1168 serviceAccountId: getenv('ANTHROPIC_SERVICE_ACCOUNT_ID'),
1169 workspaceId: getenv('ANTHROPIC_WORKSPACE_ID') ?: null,
1170 )),
11061171 ),
11071172 );
11081173
No line in this hunk matches that.