How-to
Give federated access with an identity pool
Let a workload authenticate with its Entra ID — no stored passwords or keys
What you'll achieve
An identity pool that lets an application or workload sign in with its company (Entra ID) identity — no passwords or API keys to store, rotate, or lose.
Before you start
- This is admin territory: the Access Management section only appears in the sidebar for admins. If you don't see it, ask your team's admin.
- Know which identity should be allowed in — typically the application's Entra client ID, or a group. The company Entra tenant is always enforced automatically; your filter only narrows it further.
Steps
- Click Identity Pools in the sidebar (under Access Management), then Add Identity Pool.
- Pick the Type — Producer, Consumer, Stream Processor, Auditor, Schema Writer, or Metrics; the box below shows exactly which permissions ("Role Bindings") it grants.
- In Name, type a short identifier — e.g.
order-producer. The Display Name Preview shows the final pool name. - If a Topic Prefix field appears, you can narrow which topics the pool may touch; empty allows all of your team's topics.
- In Filter Suffix, say who exactly is allowed in — for example
claims.appid == "your-app-client-id". The Filter Preview shows the complete rule (your company tenant check and your suffix). Leave it empty to allow the whole tenant — usually too broad. (More examples: filter expressions.) - Click Create Identity Pool — a progress window walks through validating, creating, and assigning permissions ("This typically takes 5-15 seconds").
What success looks like
An "Identity Pool Created" card shows the pool's name, ID
(pool-…),
filter, and a Roles table. Hand the team the pool ID (copyable
from the pool's page) — that plus their own Entra identity is all they need to authenticate.
The pool's page shows what it can access on the Access tab.
Something went wrong?
- "Identity pool created with warnings" — part of the setup didn't complete; check the details shown and contact the platform team.
- The workload can't authenticate — the filter is probably too narrow or names the wrong claim. On the pool's page, open the Settings tab and use the pencil next to the filter to fix it (Save changes); it takes effect immediately.
- Deleting an identity pool is admin-only; the pool's own page only shows the Danger Zone to admins.
Background — how federated access works, pool types, and filter syntax? Read the Identity Pools guide. Need classic key-based credentials instead? See Create a service account.