Input the private key and the client certificate with which Jenkins will authenticate itself to Microsoft Entra ID. They must be in PEM format (IETF RFC 7468 sections 10 and 5), concatenated together like this:
-----BEGIN PRIVATE KEY-----
[Base64 text not shown]
-----END PRIVATE KEY-----
-----BEGIN CERTIFICATE-----
[Base64 text not shown]
-----END CERTIFICATE-----
The private key must not be encrypted. The certificate may be self-signed, but it must not have expired.