You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/api-management/credentials-configure-common-providers.md
+22-22Lines changed: 22 additions & 22 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,70 +1,70 @@
1
1
---
2
-
title: Configure credential providers - Azure API Management | Microsoft Docs
3
-
description: Learn how to configure common credential providers in Azure API Management's credential manager. Example providers are Microsoft Entra and generic OAuth 2.0.
2
+
title: Configure Credential Providers - Azure API Management | Microsoft Docs
3
+
description: Learn how to configure common credential providers in the Azure API Management credential manager. Providers include Microsoft Entra and generic OAuth.
4
4
services: api-management
5
5
author: dlepow
6
6
ms.service: azure-api-management
7
7
ms.topic: how-to
8
-
ms.date: 11/10/2023
8
+
ms.date: 10/03/2025
9
9
ms.author: danlep
10
10
ms.custom: sfi-image-nochange
11
+
# Customer intent: As an Azure service administrator, I want to learn how to configure common credential providers in the API Management credential manager.
11
12
---
12
13
13
14
# Configure common credential providers in credential manager
In this article, you learn about configuring identity providers for managed [connections](credentials-overview.md) in your API Management instance. Settings for the following common providers are shown:
18
+
In this article, you learn about configuring identity providers for managed [connections](credentials-overview.md) in your Azure API Management instance. Settings for the following common providers are shown:
18
19
19
-
* Microsoft Entra provider
20
-
* Generic OAuth 2.0 provider
20
+
* Microsoft Entra
21
+
* Generic OAuth 2
21
22
22
-
You configure a credential provider in your API Management instance's credential manager. For a step-by-step example of configuring a Microsoft Entra provider and connection, see:
23
-
24
-
*[Configure credential manager - Microsoft Graph API](authorizations-how-to-azure-ad.md)
23
+
You configure a credential provider in the credential manager in your API Management instance. For a step-by-step example of configuring a Microsoft Entra provider and connection, see [Configure credential manager - Microsoft Graph API](authorizations-how-to-azure-ad.md).
25
24
26
25
## Prerequisites
27
26
28
27
To configure any of the supported providers in API Management, first configure an OAuth 2.0 app in the identity provider that will be used to authorize API access. For configuration details, see the provider's developer documentation.
29
28
30
-
* If you're creating a credential provider that uses the authorization code grant type, configure a **Redirect URL** (sometimes called Authorization Callback URL or a similar name) in the app. For the value, enter `https://authorization-manager.consent.azure-apim.net/redirect/apim/<YOUR-APIM-SERVICENAME>`.
29
+
* If you're creating a credential provider that uses the authorization code grant type, configure a redirect URL (sometimes called an Authorization Callback URL or a similar name) in the app. For the value, enter `https://authorization-manager.consent.azure-apim.net/redirect/apim/<API-management-instance-name>`.
31
30
32
-
* Depending on your scenario, configure app settings such as scopes (API permissions).
31
+
* Depending on your scenario, configure app settings like scopes (API permissions).
33
32
34
33
* Minimally, retrieve the following app credentials that will be configured in API Management: the app's **client ID** and **client secret**.
35
34
36
-
* Depending on the provider and your scenario, you might need to retrieve other settings such as authorization endpoint URLs or scopes.
35
+
* Depending on the provider and your scenario, you might need to retrieve other settings, like authorization endpoint URLs or scopes.
37
36
38
37
* The provider's authorization endpoints must be reachable over the internet from your API Management instance. If your API Management instance is secured in a virtual network, configure network or firewall rules to allow access to the provider's endpoints.
39
38
40
39
## Microsoft Entra provider
41
40
42
-
API credential manager supports the Microsoft Entra identity provider, which is the identity service in Microsoft Azure that provides identity management and access control capabilities. It allows users to securely sign in using industry-standard protocols.
41
+
API Management credential manager supports the Microsoft Entra identity provider, which is the identity service in Azure that provides identity management and access control capabilities. It enables users to securely sign in via industry-standard protocols.
43
42
44
-
***Supported grant types**: authorization code, client credentials
43
+
**Supported grant types**: authorization code, client credentials
45
44
46
45
> [!NOTE]
47
-
> Currently, the Microsoft Entra credential provider supports only the Azure AD v1.0 endpoints.
46
+
> Currently, the Microsoft Entra credential provider supports only Azure Active Directory v1.0 endpoints.
You can use two generic providers for configuring connections:
56
+
You can use three generic providers for configuring connections:
58
57
59
58
* Generic OAuth 2.0
60
59
* Generic OAuth 2.0 with PKCE
60
+
* Generic OAuth 2.1 with PKCE with DCR
61
61
62
-
A generic provider allows you to use your own OAuth 2.0 identity provider based on your specific needs.
62
+
A generic provider enables you to use your own OAuth identity provider, based on your specific needs.
63
63
64
64
> [!NOTE]
65
-
> We recommend using the generic OAuth 2.0 with PKCE provider for improved security if your identity provider supports it. [Learn more](https://oauth.net/2/pkce/)
65
+
> We recommend using a PKCE provider for improved security if your identity provider supports it. For more information, see [Proof Key for Code Exchange](https://oauth.net/2/pkce/).
66
66
67
-
***Supported grant types**: authorization code, client credentials
67
+
**Supported grant types**: authorization code, client credentials (depends on provider)
68
68
69
69
### Generic credential provider settings
70
70
@@ -76,9 +76,9 @@ API Management supports several providers for popular SaaS offerings, including
76
76
77
77
:::image type="content" source="media/credentials-configure-common-providers/saas-providers.png" alt-text="Screenshot of identity providers listed in the portal.":::
78
78
79
-
**Supported grant types**: authorization code, client credentials (depends on provider)
79
+
**Supported grant types**: authorization code
80
80
81
-
Required settings for these providers differ from provider to provider but are similar to those for the [generic OAuth 2.0 providers](#generic-oauth-20-providers). Consult the developer documentation for each provider.
81
+
Required settings for these providers differ, depending on the provider, but are similar to those for the [generic OAuth providers](#generic-oauth-providers). Consult the developer documentation for each provider.
> If you've enabled [logging of your API to Application insights](api-management-howto-app-insights.md), you can query the logs to see the requests and responses.
259
259
260
+
## Limitations
261
+
262
+
Self-hosted gateway instances rely on the UDP protocol for [heartbeat and rate-limit communications](self-hosted-gateway-settings-reference.md#cross-instance-discovery--synchronization). As Azure Container Apps presently does not support the UDP protocol - neither for ingress nor for internal traffic - the `rate-limit` policy cannot synchronize its counter across instances. Consequently, maintaining three replicas of a self-hosted gateway container app with limit X may well result in three times the traffic until limit X is reached.
263
+
Azure Container Apps distributes requests linearly across each available and healthy replica. To implement rate limiting, you can divide the desired limit by the number of replicas you wish to run and set the resulting value in configuration. This approach has its own downsides as you may not be able to account for adjusted counters if and when your container apps scale.
| EPC_CDROM_EMULATEMODE | This error is encountered when CD-ROM on the Virtual Machine uses emulate mode, whose ISO image isn't accessible | Follow [this KB article](https://knowledge.broadcom.com/external/article?legacyId=79306) for the removal of any CDROM mounted on customer's workload Virtual Machines in emulate mode or detach ISO. It's recommended to use "Passthrough mode" for mounting any CD-ROM. |
63
63
| EPC_DRSOVERRIDERULE | This error is encountered when there's a Virtual Machine with DRS Override set to "Disabled" mode. | VM shouldn't block vMotion while putting host into maintenance. Set Partially Automated DRS rules for the VM. Refer to [this document](/azure/azure-vmware/create-placement-policy#enable-restrict-vm-movement-for-specific-vms) to know more about VM placement policies. |
64
-
| EPC_SCSIDEVICE_SHARINGMODE | This error is encountered when a Virtual Machine is configured to use a device that prevents a maintenance operation: A device that is a SCSI controller, which is engaged in bus-sharing | Follow [this KB article](https://knowledge.broadcom.com/external/article?legacyId=79910) for the removal of any SCSI controller engaged in bus-sharing attached to VMs |
64
+
| EPC_SCSIDEVICE_SHARINGMODE | This error is encountered when a Virtual Machine is configured to use a device that prevents a maintenance operation: A device that is a SCSI controller, which is engaged in bus-sharing | Follow [this KB article](https://knowledge.broadcom.com/external/article?legacyId=79910) for the removal of any SCSI controller engaged in bus-sharing attached to VMs.|
65
65
| EPC_DATASTORE_INACCESSIBLE | This error is encountered when any external Datastore attached to AVS Private Cloud becomes inaccessible | Follow [this article](/azure/azure-vmware/attach-azure-netapp-files-to-azure-vmware-solution-hosts?tabs=azure-portal#performance-best-practices) for the removal of any stale Datastore attached to cluster |
66
-
| EPC_NWADAPTER_STALE | This error is encountered when connected Network interface on the Virtual Machine uses network adapter, which becomes inaccessible | Follow [this KB article](https://knowledge.broadcom.com/external/article/318738/troubleshooting-the-migration-compatibil.html) for the removal of any stale N/W adapters attached to Virtual Machines |
66
+
| EPC_NWADAPTER_STALE | This error is encountered when connected Network interface on the Virtual Machine uses network adapter, which becomes inaccessible | Follow [this KB article](https://knowledge.broadcom.com/external/article/318738/troubleshooting-the-migration-compatibil.html) for the removal of any stale N/W adapters attached to Virtual Machines.|
67
67
| EPC_SERIAL_PORT | This error is encountered when a Virtual Machine’s serial port is connected to a device that can't be accessed on the destination host. | If you're using an image file (ISO, FLP, and so on), ensure that it's accessible from all ESXi servers on the cluster. Store the files on a data store that is shared between all ESXi servers that participate in vMotion of the virtual machine. Refer to [this KB article](https://knowledge.broadcom.com/external/article/324829/vmotion-fails-with-the-compatibility-err.html) from Broadcom for more information. |
68
68
| EPC_HARDWARE_DEVICE | This error is encountered when a Virtual Machine’s parallel Port/USB Device is connected to a device can't be accessed on the destination host. | If you're using an image file (ISO, FLP, and so on), ensure that it's accessible from all ESXi servers of the cluster. Store the files on a data store that is shared between all ESXi servers that participate in the vMotion of the virtual machine. Refer to [this KB article](https://knowledge.broadcom.com/external/article/324829/vmotion-fails-with-the-compatibility-err.html) from Broadcom for more information. |
69
-
| EPC_INVALIDVM / EPC_ORPHANVM | This error is encountered when there's an orphaned or Invalid VM in the inventory | Ensure all your Virtual Machines are accessible to the vCenter. Refer to [this KB article](https://knowledge.broadcom.com/external/article/312831/virtual-machines-appear-as-invalid-or-or.html) for more information |
70
-
69
+
| EPC_INVALIDVM / EPC_ORPHANVM | This error is encountered when there's an orphaned or Invalid VM in the inventory | Ensure all your Virtual Machines are accessible to the vCenter. Refer to [this KB article](https://knowledge.broadcom.com/external/article/312831/virtual-machines-appear-as-invalid-or-or.html) for more information. |
70
+
| EPC_VMHOSTDRSRULE | This error is encountered when there's a Virtual Machine with Host affinity/anti-affinity DRS rule. | VM shouldn't block VMware vMotion while putting a host into maintenance mode. Set "should rules" for VM-Host affinity. Refer to [this document](/azure/azure-vmware/create-placement-policy#what-is-the-difference-between-the-vm-host-affinity-policy-and-restrict-vm-movement) for more information. |
71
+
| EPC_FTTVIOLATION | This error is encountered when a virtual machine has "Failures to Tolerate" as 0 or "No data redundancy" | Follow [this KB article](https://knowledge.broadcom.com/external/article/391522/the-esxi-host-takes-very-long-time-enter.html) to configure FTT as 1 or 2 for the Virtual Machine. |
71
72
72
73
> [!NOTE]
73
74
> Azure VMware Solution tenant admins must not edit or delete the previously defined VMware vCenter Server alarms because they're managed by the Azure VMware Solution control plane on vCenter Server. These alarms are used by Azure VMware Solution monitoring to trigger the Azure VMware Solution host remediation process.
Copy file name to clipboardExpand all lines: articles/cost-management-billing/manage/direct-ea-azure-usage-charges-invoices.md
+3-3Lines changed: 3 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,13 +1,13 @@
1
1
---
2
2
title: View your Azure usage summary details and download reports for EA enrollments
3
3
description: This article explains how enterprise administrators of direct and indirect Enterprise Agreement (EA) enrollments can view a summary of their usage data, Azure Prepayment consumed, and charges associated with other usage in the Azure portal.
Copy file name to clipboardExpand all lines: articles/cost-management-billing/manage/ea-billing-administration-partners.md
+3-3Lines changed: 3 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,13 +1,13 @@
1
1
---
2
2
title: EA billing administration for partners in the Azure portal
3
3
description: This article explains the common tasks that a partner administrator accomplishes in the Azure portal to manage indirect enterprise agreements.
![learn-build-service-prod[bot]](https://avatars.githubusercontent.com/in/237442?v=4&size=40){kind=avatar}
0 commit comments