Share via

Does Microsoft Azure Support Private_key_jwt method for authentication for UI flow

Prabhjot Kaur GILL 0 Reputation points
2026-03-11T06:45:39.5866667+00:00

For the Web UI flow, where the customer organization uses Azure AD (Entra ID) as the Identity Provider and wants to consume application services from our organization, we have been informed that Azure currently does not provide a dedicated placeholder to configure a JWKS URL. As a result, Azure is unable to dynamically fetch the public key required to validate a private_key_jwt assertion used for token endpoint authentication.

Given this limitation:

  • Is there an alternative approach by which the private_key_jwt authentication method can be supported for UI-based integrations, where Azure acts as the IdP and is expected to validate the JWT using the client’s public key?
  • If not, what recommended or supported patterns does Microsoft suggest today for such UI flows?
Microsoft Security | Microsoft Entra | Microsoft Entra ID

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Q&A Assist
    2026-03-11T06:45:54.2+00:00
    AI generated content. This question contains an answer created with AI from Q&A Assist. Learn more

    Azure supports private_key_jwt as a client authentication method in scenarios where Azure is the client authenticating to another identity provider, not as a general-purpose, UI-configurable option for validating arbitrary clients’ JWT assertions when Azure Entra ID is acting as the IdP in an interactive (UI) user flow.

    From the available information:

    1. private_key_jwt is supported as a client authentication method for applications using certificate-based credentials, as described for the Microsoft identity platform. In this pattern, an application presents a JWT assertion signed with its certificate to Azure Entra ID in flows such as client credentials or on-behalf-of. This is an app-to-IdP pattern, not a configurable “bring your own JWKS URL” for arbitrary external clients in a UI flow.
    2. In other Azure scenarios where an external OpenID Connect provider is configured (for example, when Azure is the relying party to an external IdP), private_key_jwt is supported as a client authentication method from Azure to that external IdP, with the public key exposed via the external provider’s jwks_uri. Again, this is Azure acting as the client, not as the IdP validating external clients’ keys via a configurable JWKS URL.

    Given the context, there is no documented mechanism where Azure Entra ID, acting as the IdP for an interactive web UI flow, allows configuration of a JWKS URL so that it can dynamically fetch and validate private_key_jwt assertions from arbitrary client organizations.

    Therefore, for UI-based integrations where Azure Entra ID is the IdP and must authenticate clients at the token endpoint, the recommended and supported patterns are the standard Microsoft identity platform flows and credential types:

    • Use the authorization code flow (with PKCE for public clients) for user sign-in and token acquisition.
    • Use supported client authentication methods for confidential clients registered in Entra ID (for example, client secrets or certificate credentials) rather than attempting to have Entra ID validate a private_key_jwt based on an externally hosted JWKS URL.

    Where private_key_jwt is required, the supported pattern is to use it in the direction documented: the application (or Azure as a client to another IdP) presents a JWT assertion signed with a certificate it owns, as described in the certificate credentials guidance and in the OpenID Connect client authentication specification.

    References:

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.