---
title: "POP Setup"
slug: "pop-setup-apim"
updated: 2026-10-21T08:06:38Z
published: 2026-10-21T08:06:38Z
canonical: "docs.plainid.io/pop-setup-apim"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.plainid.io/llms.txt
> Use this file to discover all available pages before exploring further.

# POP Setup

PlainID supports an Azure APIM Policy Orchestration Point (POP) in the Integrations Workspace. The POP receives the traffic that the Authorizer's MCP discovery and Insights fragments report from Azure API Management (APIM), and shows you the MCP servers, tools, and Agents the Platform discovers there.

Set up the POP before you configure APIM. For a Platform-hosted POP, creating it issues the client certificate that APIM uses to authenticate its reports. If you only use the `api-enforcement` or `mcp-enforcement` fragments, you don't need a POP.

## Prerequisites

Before you start, ensure you have:

- An Azure application registration with a Client ID and Client Secret that PlainID can use to read your APIM instance.
- Your Azure Tenant ID, Subscription ID, Resource Group, and APIM service name.
- An existing Application and a Policies Workspace in your PlainID Environment.
- For a Customer-hosted POP, an Azure Storage account and container.

## Creating the POP

**To create the POP:**

1. In the Integrations Workspace, create a new POP and select **Microsoft Azure APIM**. See [Managing POPs](/v1/docs/managing-pops) for more information.
2. Choose a **Discovery Storage Hosting** option: **Platform-hosted** or **Customer-hosted**.
3. Enter the connection details described in the table below.
4. Link an existing Application and a Policies Workspace. The Platform selects the Agent Registry as the linked Identities Workspace automatically.
5. Save the POP.
6. For a Platform-hosted POP, the **Certificate download** window opens. Select **Download** to save the certificate files to your computer, then select **Done**. You can select **Download** again while the window stays open.

### Connection Details

| Field | Description |
| --- | --- |
| **Discovery Storage Hosting** | Where the Platform stores the APIM traffic it discovers. **Platform-hosted** issues a client certificate for APIM. **Customer-hosted** stores it in your own Azure Storage account. |
| **Tenant ID** | Your Azure application's Tenant ID. |
| **Client ID** | Your Azure application's Client ID. |
| **Client Secret** | Your Azure application's Client Secret. |
| **Subscription ID** | The Azure Subscription ID that contains your APIM instance. |
| **Resource Group** | The Azure Resource Group that contains your APIM instance. |
| **APIM Service Name** | The name of your APIM service instance. |
| **Storage Account URL** | *Customer-hosted only*. Your Azure Storage account URL. |
| **Container Name** | *Customer-hosted only*. Your Azure Storage container name. |

You can change the **Client Secret** after you create the POP. All other fields are fixed at creation.

## Working with the Certificate

A Platform-hosted POP issues a client certificate that APIM presents each time it reports traffic. The certificate is valid for **one year** from the day you create the POP. Customer-hosted POPs don't issue a certificate.

### Uploading the Certificate to APIM

**To upload the certificate:**

1. In your APIM instance, go to **Security** > **Certificates**.
2. Select **+ Add** and upload the certificate file you downloaded.
3. Copy the certificate's thumbprint.
4. Enter the thumbprint as the `collectorCertificateThumbprint` named value. See [Configuring the Azure API Management Authorizer](/v1/docs/azure-api-management-authorizer-configuration) for the full list of named values.

See [Microsoft's guide to client certificate authentication](https://learn.microsoft.com/en-us/azure/api-management/api-management-howto-mutual-certificates) for more information.

### Getting a New Certificate

Get a new certificate before the current one expires, or if you lose the file.

**To get a new certificate:**

1. In the Integrations Workspace, open the **⋮** menu on the Azure APIM POP card.
2. Select **Download Certificate**. The Platform generates a new certificate and downloads it to your computer.
3. Upload the new certificate to APIM and update `collectorCertificateThumbprint` with its thumbprint.

## Viewing Discovered Objects

After APIM starts reporting, open the POP to see what the Platform discovered:

- **Observability** opens by default and shows the traffic APIM reports.
- **Vendor Objects** lists the MCP servers, tools, and Agents the Platform discovered through APIM.

## Good to Know

- The Platform discovers only operations that include the `mcp-discovery` or `insights-discoverer` fragment. See [Configuring the Azure API Management Authorizer](/v1/docs/azure-api-management-authorizer-configuration) to add them.
- Treat the certificate file as a secret. It authenticates APIM to the Platform.