Certificate added via New-AzureADApplicationKeyCredential not appearing in Azure AD discovery endpoint

Question

I'm adding a new certificate to an existing App Registration in Azure AD using the following command:

New-AzureADApplicationKeyCredential -ObjectId $AppObjectId -CustomKeyIdentifier $base64Thumbprint -Type AsymmetricX509Cert -Usage Verify -Value $base64Value -StartDate $cer.GetEffectiveDateString() -EndDate $validTo

This works OK and I can see the cert added in the Portal.

Should this certificate not also be visible via https://login.microsoftonline.com/{tenant}/discovery/keys?appid={Application(client)ID}

I've also tried adding the certificate info via Set-AzureADApplication & directly via the Portal. Each time I can see the certificate under "Certificates and Secrets" as well as in the App Manifest. No matter what I do I can't see the public cert in the JWKS endpoint.

My assumption on this comes from the following:

https://docs.microsoft.com/en-us/azure/active-directory/develop/access-tokens

"If your app has custom signing keys as a result of using the claims-mapping feature, you must append an appid query parameter containing the app ID to get a jwks_uri pointing to your app's signing key information, which should be used for validation. For example: https://login.microsoftonline.com/{tenant}/.well-known/openid-configuration?appid=6731de76-14a6-49ae-97bc-6eba6914391e contains a jwks_uri of https://login.microsoftonline.com/{tenant}/discovery/keys?appid=6731de76-14a6-49ae-97bc-6eba6914391e."

Any help would be much appreciated.

juunas juunas · Accepted Answer · 2020-05-05T17:17:44

As far as I understand, the keys you add to the app are only used for authenticating your app to Azure AD. Thus there is no need to advertise those keys in the public endpoint, as only Azure AD itself needs to use those public keys to verify assertions sent by your app.

Certificate added via New-AzureADApplicationKeyCredential not appearing in Azure AD discovery endpoint

2 Answers