docs: add authenticated silo connection sample

Directory.Packages.props

@@ -74,6 +74,8 @@
     <PackageVersion Include="Microsoft.Extensions.ObjectPool" Version="8.0.24" />
     <PackageVersion Include="Microsoft.Extensions.Options.ConfigurationExtensions" Version="8.0.0" />
     <PackageVersion Include="Microsoft.Extensions.Options" Version="8.0.2" />
+    <PackageVersion Include="Microsoft.IdentityModel.JsonWebTokens" Version="8.22.0" />
+    <PackageVersion Include="Microsoft.IdentityModel.Protocols.OpenIdConnect" Version="8.22.0" />
     <PackageVersion Include="Microsoft.Extensions.ServiceDiscovery" Version="10.3.0" />
     <PackageVersion Include="Microsoft.Extensions.TimeProvider.Testing" Version="9.10.0" />
     <PackageVersion Include="Microsoft.NET.Test.Sdk" Version="18.0.1" />

Orleans.slnx

@@ -67,6 +67,7 @@
     <Project Path="src/Orleans.Clustering.Consul/Orleans.Clustering.Consul.csproj" />
     <Project Path="src/Orleans.Clustering.ZooKeeper/Orleans.Clustering.ZooKeeper.csproj" />
     <Project Path="src/Orleans.Connections.Security/Orleans.Connections.Security.csproj" />
+    <Project Path="src/Orleans.Connections.Security.Entra/Orleans.Connections.Security.Entra.csproj" />
     <Project Path="src/Orleans.Hosting.Kubernetes/Orleans.Hosting.Kubernetes.csproj" />
   </Folder>
   <Folder Name="/src/Extensions/AdoNet/">
@@ -130,6 +131,7 @@
     <Project Path="test/Orleans.DependencyInjection.Tests/Orleans.DependencyInjection.Tests.csproj" />
     <Project Path="test/Orleans.Core.Tests/Orleans.Core.Tests.csproj" />
     <Project Path="test/Orleans.CodeGenerator.Tests/Orleans.CodeGenerator.Tests.csproj" />
+    <Project Path="test/Orleans.Connections.Security.Entra.Tests/Orleans.Connections.Security.Entra.Tests.csproj" />
     <Project Path="test/Orleans.Connections.Security.Tests/Orleans.Connections.Security.Tests.csproj" />
     <Project Path="test/Orleans.Journaling.Tests/Orleans.Journaling.Tests.csproj" />
     <Project Path="test/Orleans.Journaling.Json.Tests/Orleans.Journaling.Json.Tests.csproj" />

docs/site/src/content/docs/deployment/networking.md

@@ -1,7 +1,7 @@
 ---
 title: Topology, networking, and clustering
 description: Configure Orleans endpoints, network paths, and cluster discovery for production.
-ms.date: 08/02/2026
+ms.date: 08/07/2026
 ms.topic: concept-article
 ---
 
@@ -82,7 +82,10 @@ Allow only the required paths:
 - Application ingress: the application's HTTP, gRPC, or other public protocol.
 - Provider endpoints: the identities and destinations required by each configured provider.
 
-Don't expose the silo port or gateway port to the public internet. If clients cross an untrusted network, use [Orleans TLS](../host/transport-layer-security.md) and enforce workload identity at the surrounding network boundary.
+Don't expose the silo port or gateway port to the public internet. Protect
+Orleans traffic with [TLS](../host/transport-layer-security.md), and use
+[authenticated Orleans connections](../host/authenticated-silo-connections.md)
+when silos or clients must prove workload identity at the transport boundary.
 
 ## Validate connectivity
 

docs/site/src/content/docs/deployment/production-readiness.md

@@ -1,7 +1,7 @@
 ---
 title: Production-readiness checklist
 description: Review an Orleans deployment before it receives production traffic.
-ms.date: 08/02/2026
+ms.date: 08/07/2026
 ms.topic: checklist
 ---
 
@@ -44,10 +44,15 @@ Complete this checklist for each production environment. Record owners, expected
 ## Security and access
 
 - [ ] Only trusted workloads can reach silo and gateway ports.
-- [ ] Orleans transport security is configured when the network isn't already a trusted, isolated boundary. See [Orleans Transport Layer Security](../host/transport-layer-security.md).
+- [ ] TLS protects silo-to-silo and client-to-gateway traffic, with platform chain, DNS-name, EKU, and revocation validation. See [Secure Orleans connections with TLS](../host/transport-layer-security.md).
+- [ ] Workload authentication uses cluster-specific audiences, separate silo and client roles, explicit caller allowlists, and fail-closed enforcement. See [Authenticate Orleans connections](../host/authenticated-silo-connections.md).
+- [ ] Every silo and external Orleans client admitted by these policies is trusted to access the cluster; untrusted users are authenticated and authorized at application ingress.
+- [ ] Membership, storage, reminder, and stream providers independently use encrypted transport, workload identity, and least-privilege permissions.
+- [ ] Configured providers and persisted data are treated as trusted cluster infrastructure, with administrative access restricted accordingly.
 - [ ] Administrative endpoints, health details, metrics, and logs don't expose secrets or tenant data.
 - [ ] Provider identities have least privilege for membership, state, reminders, and streams.
 - [ ] Certificates and credentials have rotation and expiry alerts.
+- [ ] Negative connection tests prove that wrong certificates, tenants, audiences, roles, caller IDs, and baseline-only peers are rejected.
 
 ## Observability and operations