Application Gateway for Containers now supports centralized JSON Web Token validation through the AuthPolicy custom resource. Teams can validate a token signature, issuer, lifetime, and configured audience by using signing keys retrieved from a trusted HTTPS JSON Web Key Set endpoint. Requests with missing or invalid credentials are rejected at the gateway instead of being forwarded to the backend.
Azure update ID: 576382
Published: Nov 2, 2026
Status: In preview
Timeline: November 2026 Preview
Product: Application Gateway
Tag: Features
Category: Networking, Security
AuthPolicy can protect an ApplicationLoadBalancer, Gateway, HTTPRoute, GRPCRoute, or MCPRoute. Policies inherit through the resource hierarchy, while a more specific route-level policy can replace an inherited policy or explicitly opt a route out. Optional OAuth Protected Resource Metadata helps OAuth-aware clients discover authorization servers and supported scopes.
- Apply consistent JWT validation to HTTP, gRPC, and MCP routes
- Use Microsoft Entra ID or third-party identity providers that publish trusted JWKS signing keys
- Combine JWT validation with WAF so malicious traffic is inspected before authentication
- Publish OAuth resource metadata to enable authorization server discovery
Learn more:
- JWT validation for Application Gateway for Containers
- Configure JWT validation for Application Gateway for Containers – Gateway API