> ## Documentation Index
> Fetch the complete documentation index at: https://www.truefoundry.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Azure Entra ID Client Secret Based Authentication

> Configure client secret based authentication for Azure OpenAI, Azure AI Foundry models, and Azure guardrails (PII, Content Safety, Prompt Shield)

This guide explains how to configure client secret based authentication using Microsoft Entra ID
for Azure OpenAI and Azure AI Foundry models in TrueFoundry's AI Gateway. Client secret authentication
is also supported for Azure AI Foundry-based guardrails — [Azure PII](/docs/ai-gateway/azure-pii),
[Azure Content Safety](/docs/ai-gateway/azure-content-safety), and
[Azure Prompt Shield](/docs/ai-gateway/azure-prompt-shield).

If you prefer certificate-based authentication instead, see
[Azure Entra ID Certificate Based Authentication](/docs/ai-gateway/azure-entra-certificate-auth).

## Prerequisites

* A [Microsoft Entra ID application](https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-register-app)
  registered in your Azure tenant
* Azure OpenAI or Azure AI Foundry resource deployed

## Azure Configuration

<Steps>
  <Step title="Get Application Details from Entra ID">
    Navigate to [Azure Portal](https://portal.azure.com) > **Microsoft Entra ID** >
    **App registrations** and select your application.

    From the **Overview** page, note the following values:

    * **Application (client) ID**
    * **Directory (tenant) ID**
  </Step>

  <Step title="Create a Client Secret">
    In your app registration, navigate to **Certificates & secrets** > **Client secrets** >
    **New client secret**.

    Provide a **Description** and choose an **Expires** duration, then click **Add**.

    <Warning>
      Copy the secret **Value** immediately after creation — Azure only displays it once.
      Store it in a secure location; you will provide it to TrueFoundry in the next section.
    </Warning>

    <Frame caption="Client secrets tab in Certificates & secrets showing a created secret">
      <img src="https://mintcdn.com/truefoundry/j9rPu6DVCey7DfPM/images/azure-entra-client-secret-create.png?fit=max&auto=format&n=j9rPu6DVCey7DfPM&q=85&s=97270a7109979a0fd286fb63b8e3409a" alt="Azure app registration Certificates and secrets page with a client secret created under the Client secrets tab" width="2062" height="1056" data-path="images/azure-entra-client-secret-create.png" />
    </Frame>
  </Step>

  <Step title="Assign RBAC Role to App Registration">
    Navigate to your **Azure resource** > **Access control (IAM)** > **Add role assignment**.

    <Tabs>
      <Tab title="Azure OpenAI">
        Assign **Cognitive Services OpenAI User** role to your app registration.

        [Learn more about Azure OpenAI RBAC](https://learn.microsoft.com/en-us/azure/ai-services/openai/how-to/role-based-access-control)
      </Tab>

      <Tab title="Azure AI Foundry">
        Assign **Azure AI User** role to your app registration.

        [Learn more about Azure AI Foundry RBAC](https://learn.microsoft.com/en-us/azure/ai-foundry/concepts/rbac-azure-ai-foundry)
      </Tab>
    </Tabs>

    <Frame caption="Add role assignment for app registration">
      <img src="https://mintcdn.com/truefoundry/62IaXsiblF4PkZxX/images/azure-iam-role-assignment.png?fit=max&auto=format&n=62IaXsiblF4PkZxX&q=85&s=6e726d6aa341dfaf5d99d879431bf526" alt="Access control IAM page showing role assignment" width="2014" height="860" data-path="images/azure-iam-role-assignment.png" />
    </Frame>

    <Info>
      Role assignments may take a few minutes to propagate.
    </Info>
  </Step>
</Steps>

## TrueFoundry Configuration

<Steps>
  <Step title="Add Provider Account with Client Secret Authentication">
    Navigate to **AI Gateway** > **Models** and select your provider (Azure OpenAI or Azure AI Foundry).

    Click **Add Account** and select **Entra client secret based auth**. Fill in the following:

    | Field         | Description                                                                                                                 |
    | ------------- | --------------------------------------------------------------------------------------------------------------------------- |
    | Tenant ID     | Directory (tenant) ID from app registration overview                                                                        |
    | Client ID     | Application (client) ID from app registration overview. You can also use a [TrueFoundry Secret](/docs/manage-secrets) here. |
    | Client Secret | The client secret **Value** you copied from Azure. You can also use a [TrueFoundry Secret](/docs/manage-secrets) here.      |

    <Note>
      For Azure AI Foundry, client secret authentication is configured at the **model level**,
      not the account level.
    </Note>

    <Frame caption="Azure OpenAI account form with Entra client secret based auth selected">
      <img src="https://mintcdn.com/truefoundry/1HGc6pZXOp0t3YWO/images/tfy-azure-client-secret-config.png?fit=max&auto=format&n=1HGc6pZXOp0t3YWO&q=85&s=ea2c07dc3d66499e0598c9fd387e74d5" alt="TrueFoundry Azure OpenAI account form with client secret authentication fields" width="2092" height="1130" data-path="images/tfy-azure-client-secret-config.png" />
    </Frame>
  </Step>

  <Step title="Add Models and Test">
    Add your models as described in the [Azure OpenAI](/docs/ai-gateway/azure-openai) or
    [Azure AI Foundry](/docs/ai-gateway/azure-ai-foundry) documentation.

    Test the connection using the Playground to verify authentication works.
  </Step>
</Steps>

## Reference Links

* [Register an Entra ID application](https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-register-app)
* [Add credentials to a Microsoft Entra application](https://learn.microsoft.com/en-us/entra/identity-platform/how-to-add-credentials)
* [Microsoft identity platform and OAuth 2.0 client credentials flow](https://learn.microsoft.com/en-us/entra/identity-platform/v2-oauth2-client-creds-grant-flow)
* [Azure OpenAI RBAC](https://learn.microsoft.com/en-us/azure/ai-services/openai/how-to/role-based-access-control)
* [Azure AI Foundry RBAC](https://learn.microsoft.com/en-us/azure/ai-foundry/concepts/rbac-azure-ai-foundry)