The expected audience for tokens from this provider
OptionalclientOAuth client ID for this provider (used by OAuth proxy for upstream auth)
ProtectedconfigOptionaldomainProvider domain hosting the OAuth endpoints when they aren't on the issuer (used by OAuth proxy)
The issuer URL for this provider (must match the 'iss' claim in tokens)
ProtectedjwksThe JWKS endpoint URL for retrieving signing keys
Unique name identifier for this provider
Extracts user information from MSAL/Azure AD JWT payload
Gets the signing key for token verification with retry logic
Checks if a given issuer URL belongs to this provider
Validates MSAL-specific configuration
StaticConfigConfigures Microsoft Entra ID from TENANT_ID + WEB_CLIENT_ID.
Mapping preserved byte-for-byte from the env block that previously lived in MJServer's config — including the provider name 'azure', which predates the Entra rename and is kept so existing deployments' registered provider names do not shift.
Microsoft Authentication Library (MSAL) provider implementation