PlainID supports an Azure APIM Policy Orchestration Point (POP) in the Integrations Workspace. The POP receives the traffic that the Authorizer's MCP discovery and Insights fragments report from Azure API Management (APIM), and shows you the MCP servers, tools, and Agents the Platform discovers there.
Set up the POP before you configure APIM. For a Platform-hosted POP, creating it issues the client certificate that APIM uses to authenticate its reports. If you only use the api-enforcement or mcp-enforcement fragments, you don't need a POP.
Prerequisites
Before you start, ensure you have:
- An Azure application registration with a Client ID and Client Secret that PlainID can use to read your APIM instance.
- Your Azure Tenant ID, Subscription ID, Resource Group, and APIM service name.
- An existing Application and an Authorization Workspace in your PlainID Environment.
- For a Customer-hosted POP, an Azure Storage account and container.
Creating the POP
To create the POP:
- In the Integrations Workspace, create a new POP and select Microsoft Azure APIM. See Managing POPs for more information.
- Choose a Discovery Storage Hosting option: Platform-hosted or Customer-hosted.
- Enter the connection details described in the table below.
- Link an existing Application and an Authorization Workspace. The Platform selects the Agent Registry as the linked Identity Workspace automatically.
- Save the POP.
- For a Platform-hosted POP, the Certificate download window opens. Select Download to save the certificate files to your computer, then select Done. You can select Download again while the window stays open.
Connection Details
| Field | Description |
|---|---|
| Discovery Storage Hosting | Where the Platform stores the APIM traffic it discovers. Platform-hosted issues a client certificate for APIM. Customer-hosted stores it in your own Azure Storage account. |
| Tenant ID | Your Azure application's Tenant ID. |
| Client ID | Your Azure application's Client ID. |
| Client Secret | Your Azure application's Client Secret. |
| Subscription ID | The Azure Subscription ID that contains your APIM instance. |
| Resource Group | The Azure Resource Group that contains your APIM instance. |
| APIM Service Name | The name of your APIM service instance. |
| Storage Account URL | Customer-hosted only. Your Azure Storage account URL. |
| Container Name | Customer-hosted only. Your Azure Storage container name. |
You can change the Client Secret after you create the POP. All other fields are fixed at creation.
Working with the Certificate
A Platform-hosted POP issues a client certificate that APIM presents each time it reports traffic. The certificate is valid for one year from the day you create the POP. Customer-hosted POPs don't issue a certificate.
Uploading the Certificate to APIM
To upload the certificate:
- In your APIM instance, go to Security > Certificates.
- Select + Add and upload the certificate file you downloaded.
- Copy the certificate's thumbprint.
- Enter the thumbprint as the
collectorCertificateThumbprintnamed value. See Configuring the Azure API Management Authorizer for the full list of named values.
See Microsoft's guide to client certificate authentication for more information.
Getting a New Certificate
Get a new certificate before the current one expires, or if you lose the file.
To get a new certificate:
- In the Integrations Workspace, open the ⋮ menu on the Azure APIM POP card.
- Select Download Certificate. The Platform generates a new certificate and downloads it to your computer.
- Upload the new certificate to APIM and update
collectorCertificateThumbprintwith its thumbprint.
Viewing Discovered Objects
After APIM starts reporting, open the POP to see what the Platform discovered:
- Observability opens by default and shows the traffic APIM reports.
- Vendor Objects lists the MCP servers, tools, and Agents the Platform discovered through APIM.
Good to Know
- The Platform discovers only operations that include the
mcp-discoveryorinsights-discovererfragment. See Configuring the Azure API Management Authorizer to add them. - Treat the certificate file as a secret. It authenticates APIM to the Platform.