Application Gateway for Containers now supports centralized
JSON Web Token validation through the AuthPolicy custom resource. Teams can
validate a token signature, issuer, lifetime, and configured audience by using
signing keys retrieved from a trusted HTTPS JSON Web Key Set endpoint. Requests
with missing or invalid credentials are rejected at the gateway instead of
being forwarded to the backend.
AuthPolicy can protect an ApplicationLoadBalancer, Gateway,
HTTPRoute, GRPCRoute, or MCPRoute. Policies inherit through the resource
hierarchy, while a more specific route-level policy can replace an inherited
policy or explicitly opt a route out. Optional OAuth Protected Resource
Metadata helps OAuth-aware clients discover authorization servers and supported
scopes.
- Apply consistent JWT
validation to HTTP, gRPC, and MCP routes
- Use
Microsoft Entra ID or third-party identity providers that publish trusted
JWKS signing keys
- Combine
JWT validation with WAF so malicious traffic is inspected before
authentication
- Publish
OAuth resource metadata to enable authorization server discovery
Learn more: