Comma- or newline-separated Jenkins user ids of local accounts (typically CI service accounts) that do not exist in Entra ID but whose API tokens should keep working after switching to this security realm.

Jenkins validates API tokens against the local user record, but then asks the security realm for the user's details. Without this allowlist the Entra ID lookup fails for local-only users and the request is rejected. Names listed here are treated as "the realm cannot tell whether this user exists", which lets API-token authentication proceed with the user's last granted authorities.

Leave empty (the default) if all your users exist in Entra ID. Interactive login is never possible for these accounts; deleting a user from Entra ID keeps invalidating their API tokens regardless of this setting.