# OpenZiti identity with Entra-signed JWT cannot access resources **URL:** \ **Category:** Ziti Overlay\ **Created:** [August 10, 2026, 8:07am UTC](https://openziti.discourse.group/t/openziti-identity-with-entra-signed-jwt-cannot-access-resources/5997 "2026-08-10T08:07:26Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![carol](https://avatars.discourse-cdn.com/v4/letter/c/9d8465/32.png) [@carol](https://openziti.discourse.group/u/carol)\ **Post date:** [August 10, 2026, 8:07am UTC](https://openziti.discourse.group/t/openziti-identity-with-entra-signed-jwt-cannot-access-resources/5997/1 "2026-08-10T08:07:26Z")
Hello everyone, Iโ€™m running OpenZiti, and overall everything is working fine. Last week, I tried to configure network access through identity, but itโ€™s not working as expected. Sometimes I can log in to the UI console using a Microsoft Entra user. When I create an identity with a JWT signed by Entra, I can add the identity and Entra authentication appears to succeed. However, in the UI the user is shown as **not connected** (`Router Connection: No`, `API Connection: No`), so this user cannot access any resources. Also, the Entra JWT user has the **same service permissions** as users with **default authentication**. Those same services and routers are accessible for users with default auth, but not for the Entra JWT user. Has anyone seen this behavior before or knows how to fix it? Any help would be greatly appreciated. ![image](https://global.discourse-cdn.com/free1/uploads/netfoundry/original/2X/a/a757d681cd5cdd7419ef20928d94b6c2f71a6475.png) ![image](https://global.discourse-cdn.com/free1/uploads/netfoundry/original/2X/3/3d6d2b208bf8ffffbb0f747b64efc808ca834cbb.png) ![image](https://global.discourse-cdn.com/free1/uploads/netfoundry/original/2X/e/e65cab67f2983aff2b5ebcea319842a6c9b46b14.png) ---
**Author:** ![TheLumberjack](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thelumberjack/32/113_2.png) [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\ **Post date:** [August 10, 2026, 1:54pm UTC](https://openziti.discourse.group/t/openziti-identity-with-entra-signed-jwt-cannot-access-resources/5997/2 "2026-08-10T13:54:46Z")
Hi @carol, welcome to the community and to OpenZiti! We're glad things are working well. > [@carol](#): > > the Entra JWT user has the **same service permissions** as users This is easy to get wrong, so you'll forgive me if I ask if you're certain. ๐Ÿ™‚ Can you run: ```auto ziti edge policy-advisor identities login-CG-ADM -q ``` (or whatever that identity name is) You should see results like: ```auto OKAY : login-CG-ADM(1) -> normal-user-01.svc.0.ziti (1) Common Routers: (1/1) Dial: Y Bind: N ``` can you verify you can see the service you expect to see? Also can you look through the logs for any obvious signs of errors? ---
**Author:** ![carol](https://avatars.discourse-cdn.com/v4/letter/c/9d8465/32.png) [@carol](https://openziti.discourse.group/u/carol)\ **Post date:** [August 11, 2026, 9:22am UTC](https://openziti.discourse.group/t/openziti-identity-with-entra-signed-jwt-cannot-access-resources/5997/3 "2026-08-11T09:22:16Z")
Hi @TheLumberjack , thank you very much for the warm welcome! ๐Ÿ˜‰ So far, Iโ€™m generally very satisfied with the product, and Iโ€™m really happy to join the OpenZiti community. Iโ€™m looking forward to learning more, sharing experiences, and connecting with everyone here! This is what appears when I run the command "ziti edge policy-advisor identities login-CG-ADM -q" ![image](https://global.discourse-cdn.com/free1/uploads/netfoundry/original/2X/c/c10f9303f721d342efd336e431e99474c0c87a49.png) I should also mention that the DNS name configured during the creation of the Ziti network was, for example, `ziti.test`. However, the automatically generated certificate for this domain is reported as invalid when I try to add the network to Ziti Edge. To work around this, I created a separate domain, `ui.ziti.test`, and configured it with a Let's Encrypt certificate so that I can access the Ziti UI through a trusted HTTPS connection. When I add the network using the address [https://ui.ziti.test](https://ui.ziti.test), the identity successfully loads the connection to the IdP. I am able to authenticate the user with my Entra account, and the services are visible in the UI. However, the services remain inaccessible and I cannot establish a connection to them. Interestingly, when I add the identity as an administrator, I can also log in to the Ziti UI using my Entra account and perform all administrative tasks successfully. This suggests that the Entra ID authentication and the connection to the IdP are working correctly However, the services remain inaccessible and I cannot establish a connection to them. [2026-08-11T08:11:09.070Z] INFO tunnel-cbs:ziti\_tunnel\_ctrl.c:1042 on\_ziti\_event() ziti\_ctx[login-CG-ADM] connected to controller [2026-08-11T08:11:09.087Z] DEBUG ziti-edge-tunnel:ipc\_event.c:119 send\_events\_message() Events Message =\> {"Op":"identity","Action":"added","Fingerprint":"ui.ziti.test\_7112","Id":{"Name":"login-CG-ADM","Identifier":"c:\windows\system32\config\systemprofile\appdata\roaming\netfoundry\ui.ziti.test\_7112.json","FingerPrint":"ui.ziti.test\_7112","Active":true,"Loaded":true,"Config":{"ztAPI":"[https://ziti.test:7112/"},"ControllerVersion":"v2.0.1","IdFileStatus":false,"NeedsExtAuth":false,"ExtAuthProviders":["OIDC-Enroll-JWT-Signer"],"MfaEnabled":false,"MfaNeeded":false,"Metrics":{"Up":0,"Down":0},"MfaMinTimeout":0,"MfaMaxTimeout":0,"MfaMinTimeoutRem":0,"MfaMaxTimeoutRem":0,"MinTimeoutRemInSvcEvent":0,"MaxTimeoutRemInSvcEvent":0,"Deleted":false,"Notified](https://ziti.test:7112/%22%7D,%22ControllerVersion%22:%22v2.0.1%22,%22IdFileStatus%22:false,%22NeedsExtAuth%22:false,%22ExtAuthProviders%22:%5B%22OIDC-Enroll-JWT-Signer%22%5D,%22MfaEnabled%22:false,%22MfaNeeded%22:false,%22Metrics%22:%7B%22Up%22:0,%22Down%22:0%7D,%22MfaMinTimeout%22:0,%22MfaMaxTimeout%22:0,%22MfaMinTimeoutRem%22:0,%22MfaMaxTimeoutRem%22:0,%22MinTimeoutRemInSvcEvent%22:0,%22MaxTimeoutRemInSvcEvent%22:0,%22Deleted%22:false,%22Notified)":false}} Is this information enough? Or could you tell me how to find the specific information you need? ๐Ÿ™‚