Public Preview: JWT validation for Application Gateway for Containers

Application Gateway for Containers now supports centralized JSON Web Token validation through the AuthPolicy custom resource. Teams can validate a token signature, issuer, lifetime, and configured audience by using signing keys retrieved from a trusted HTTPS JSON Web Key Set endpoint. Requests with missing or invalid credentials are rejected at the gateway instead of being forwarded to the backend.

AuthPolicy can protect an ApplicationLoadBalancer, Gateway, HTTPRoute, GRPCRoute, or MCPRoute. Policies inherit through the resource hierarchy, while a more specific route-level policy can replace an inherited policy or explicitly opt a route out. Optional OAuth Protected Resource Metadata helps OAuth-aware clients discover authorization servers and supported scopes.

- Apply consistent JWT validation to HTTP, gRPC, and MCP routes

- Use Microsoft Entra ID or third-party identity providers that publish trusted JWKS signing keys

- Combine JWT validation with WAF so malicious traffic is inspected before authentication

- Publish OAuth resource metadata to enable authorization server discovery

Learn more:

- JWT validation for Application Gateway for Containers

- Configure JWT validation for Application Gateway for Containers - Gateway API