Azure workloads authenticate to the Claude API by presenting a JSON Web Token (JWT) issued by Microsoft Entra ID, then exchanging it for a short-lived Anthropic access token. The setup follows the same shape on every Azure platform:

1. Register the token audience: Create one app registration in your Microsoft Entra tenant to represent the Claude API audience. Every workload in the tenant requests Entra tokens for it.
2. Set up the identity for your platform: A managed identity on VMs, VM Scale Sets, App Service, Functions, and Container Apps, or Entra Workload Identity on AKS.
3. Configure Anthropic: Register your tenant's Entra issuer, create a service account, and write a federation rule that matches the token's claims.
4. Exchange at runtime: Your workload exchanges its Entra-issued token at POST /v1/oauth/token for an sk-ant-oat01-... Anthropic access token and calls Claude with it.

On both paths the token you present to Anthropic carries your tenant-specific Entra issuer and the managed identity's object ID in the sub and oid claims; only how the workload obtains that token differs. Pick the section for where your workload runs: Use a managed identity for VMs, VM Scale Sets, App Service, Functions, or Container Apps; Use Entra Workload Identity on AKS for AKS.

本篇目录

• Prerequisites
• Register the token audience
• Use a managed identity
• Use Entra Workload Identity on AKS
• If your tokens are v1.0
• Scope your rule
• Next steps