Workload identity: Azure

⚠️

Preview — this feature is being built; the design below is the spec.

Workloads on Azure (App Service, Functions, Container Apps, virtual machines, and AKS with workload identity) can use a managed identity to get a token from Microsoft Entra ID. Exchange it for a Syntic access token, and the workload calls the Syntic API with no stored key.

Claims you can match on

Claim	Example	Use it to
`tid`	`0d3f...` (your tenant id)	Always include: limits trust to your tenant.
`oid`	`7a1c...`	The managed identity’s object id. Trust one identity.
`sub`	Same as `oid` for managed identities	Alternative to `oid`.
`azp`	Client id of the identity	Alternative identifier.

The issuer is https://login.microsoftonline.com/<tenant-id>/v2.0.

Set it up

Register an audience

Token requests in Entra name a resource. Create (or reuse) an app registration that represents the Syntic API in your tenant, with an application ID URI such as api://syntic. Your workloads request tokens for that audience.

Create the Syntic service account and trust rule

{
  "issuer": "https://login.microsoftonline.com/0d3f0000-0000-0000-0000-000000000000/v2.0",
  "audience": "api://syntic",
  "conditions": {
    "tid": "0d3f0000-0000-0000-0000-000000000000",
    "oid": "7a1c0000-0000-0000-0000-000000000000"
  },
  "max_token_lifetime_seconds": 900
}

Fetch and exchange the token

# pip install azure-identity requests
import requests
from azure.identity import ManagedIdentityCredential
 
entra = ManagedIdentityCredential().get_token("api://syntic/.default").token
tok = requests.post(
    "https://app.syntic.ai/v1/oauth/token",
    headers={"syntic-beta": "token-exchange-2026-11-01"},
    json={
        "grant_type": "urn:ietf:params:oauth:grant-type:token-exchange",
        "subject_token": entra,
        "subject_token_type": "urn:ietf:params:oauth:token-type:jwt",
        "service_account": "svcacct_01JCB3D5F7H9K1M3P5R7",
    },
    timeout=30,
).json()

Always include tid in the conditions. Entra’s issuer is per tenant, but checking the tenant claim as well guards against a misconfigured issuer.

Workload identity
Kubernetes: AKS pods with projected service-account tokens.
Exchange a workload token

AWS Kubernetes

Was this page helpful?