Prerequisites

• Familiarity with WIF concepts: service accounts, federation issuers, and federation rules.
• An Azure subscription with permission to assign managed identities (or configure Entra Workload Identity on AKS).
• Permission to create one app registration and service principal in your Microsoft Entra tenant (the shared Claude API audience). Entra only issues tokens for an audience that exists in the tenant, so the Register the token audience step is required before any token request succeeds.
• Your Microsoft Entra tenant ID. Find it in the Azure portal under Microsoft Entra ID → Overview → Tenant ID.
• Permission to create service accounts, federation issuers, and federation rules in the Claude Console for your Anthropic organization.