skills.rest
AzureAD
AzureADOFFICIAL
Explore all skills by this author →
WebsiteGitHub

boundcredentials

Configure mTLS proof-of-possession tokens for downstream API calls in Microsoft.Identity.Web.

786|272|Updated Feb 18, 2020
Search Tags:#azure-key-vault#mtls#aspnet-core#microsoft-identity-web#token-binding#managed-identity#proof-of-possession
One-click install
npx skills add https://github.com/AzureAD/microsoft-identity-web --skill boundcredentials
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: boundcredentials
Source: https://github.com/AzureAD/microsoft-identity-web/tree/main/.github/skills/boundcredentials
Command: npx skills add https://github.com/AzureAD/microsoft-identity-web --skill boundcredentials

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Configuring mTLS Proof-of-Possession (PoP) authentication is complex because the setup differs across credential types (certificate, managed identity, federated identity credential) and resources like Azure Key Vault require special headers. This Skill provides the exact configuration patterns and troubleshooting guidance needed to bind access tokens to client certificates correctly.

Core Features & Use Cases

  • Three Credential Patterns: Complete configuration for certificate credentials (Key Vault, store, or file), pure managed identity via IMDS v2, and federated identity credentials (FIC) using signed assertions.
  • Azure Key Vault Support: Explains the required x-ms-tokenboundauth extra header for AKV's TLS renegotiation, including sovereign cloud endpoints for China and US Government.
  • Troubleshooting Guide: Maps common 401 errors and MSAL exceptions to their root causes and fixes.
  • Use Case: You have a daemon app on an Azure VM that must call Azure Key Vault with token-bound authentication. Use this Skill to configure ProtocolScheme = "MTLS_POP" with a user-assigned managed identity and the required extra header.

Quick Start

Ask the AI to configure an mTLS PoP downstream API call to Azure Key Vault using a user-assigned managed identity in Microsoft.Identity.Web.

Frequently Asked Questions about boundcredentials

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I configure mTLS PoP with Microsoft.Identity.Web?▼

Set ProtocolScheme to "MTLS_POP" in your DownstreamApi configuration along with RequestAppToken and the target scopes. Microsoft.Identity.Web then acquires a proof-of-possession token via MSAL and attaches the binding certificate to the outgoing TLS connection.

How to use managed identity with mTLS PoP tokens?▼

Add an AcquireTokenOptions.ManagedIdentity section to your DownstreamApi config, optionally specifying UserAssignedClientId for user-assigned identity. The binding certificate comes from the IMDS v2 credential endpoint, which requires an Azure VM or VMSS.

Why does Azure Key Vault return 401 with an MTLS_POP token?▼

Azure Key Vault uses TLS renegotiation for client certificate presentation and requires the x-ms-tokenboundauth: true header. Add it via ExtraHeaderParameters in your AKV service configuration; other resources like ARM and Graph do not need this header.

Does mTLS PoP work outside Azure VMs?▼

Pure managed identity mTLS PoP requires the IMDS v2 endpoint, available only on Azure VMs and VMSS. For local development or other platforms, use a certificate credential from Key Vault, a certificate store, or a PFX file instead.

What is the difference between FIC and pure MSI for mTLS PoP?▼

FIC uses a managed identity's signed assertion as a client credential for a regular Entra ID app registration, configured under AzureAd.ClientCredentials. Pure MSI acquires the token and binding certificate directly from IMDS v2 without an app registration credential.

Related Skills

Explore More Software Engineering Skills→
davidrrowleydavidrrowley

azure-keyvault-certificates-rust

Manage Azure Key Vault certificates from Rust applications.

Community
Intermediate
ChiejiChieji

azure-compute

Recommend Azure VM sizes, VMSS configurations, and pricing via the Retail Prices API.

Community
Advanced
carlosnettocarlosnetto

x9-inspect-cert

Inspect JWKS files and certificate chains for X9.150 implementations.

Community
Intermediate
taracodlabstaracodlabs
779

xitter

Automate posting, reading, and searching X content via x-cli or X API v2.

Official
Intermediate