diff --git a/conf/defaults.ini b/conf/defaults.ini
index d15ceb1db10..15df83bbc71 100644
--- a/conf/defaults.ini
+++ b/conf/defaults.ini
@@ -962,6 +962,11 @@ user_identity_client_id =
 # By default is the same as used in AAD authentication or can be set to another application (for OBO flow)
 user_identity_client_secret =
 
+# Allows the usage of a custom token request assertion when Grafana is behind an authentication proxy
+# In most cases this will not need to be used. To enable this set the value to "username"
+# The default is empty and any other value will not enable this functionality
+username_assertion =
+
 # Set the plugins that will receive Azure settings for each request (via plugin context)
 # By default this will include all Grafana Labs owned Azure plugins, or those that make use of Azure settings (Azure Monitor, Azure Data Explorer, Prometheus, MSSQL).
 forward_settings_to_plugins = grafana-azure-monitor-datasource, prometheus, grafana-azure-data-explorer-datasource, mssql
diff --git a/conf/sample.ini b/conf/sample.ini
index f315784fed2..7ae9dcc74b9 100644
--- a/conf/sample.ini
+++ b/conf/sample.ini
@@ -886,6 +886,11 @@
 # By default is the same as used in AAD authentication or can be set to another application (for OBO flow)
 ;user_identity_client_secret =
 
+# Allows the usage of a custom token request assertion when Grafana is behind an authentication proxy
+# In most cases this will not need to be used. To enable this set the value to "username"
+# The default is empty and any other value will not enable this functionality
+;username_assertion =
+
 # Set the plugins that will receive Azure settings for each request (via plugin context)
 # By default this will include all Grafana Labs owned Azure plugins, or those that make use of Azure settings (Azure Monitor, Azure Data Explorer, Prometheus, MSSQL).
 ;forward_settings_to_plugins = grafana-azure-monitor-datasource, prometheus, grafana-azure-data-explorer-datasource, mssql
diff --git a/pkg/setting/setting_azure.go b/pkg/setting/setting_azure.go
index dc50750ccdf..e27a238cfbc 100644
--- a/pkg/setting/setting_azure.go
+++ b/pkg/setting/setting_azure.go
@@ -64,6 +64,9 @@ func (cfg *Cfg) readAzureSettings() {
 		if val := azureSection.Key("user_identity_client_secret").String(); val != "" {
 			tokenEndpointSettings.ClientSecret = val
 		}
+		if val := azureSection.Key("username_assertion").String(); val != "" && val == "username" {
+			tokenEndpointSettings.UsernameAssertion = true
+		}
 
 		azureSettings.UserIdentityTokenEndpoint = tokenEndpointSettings
 		azureSettings.UserIdentityFallbackCredentialsEnabled = azureSection.Key("user_identity_fallback_credentials_enabled").MustBool(true)
diff --git a/pkg/setting/setting_azure_test.go b/pkg/setting/setting_azure_test.go
index 6dd67f7313f..c0bc668b6d0 100644
--- a/pkg/setting/setting_azure_test.go
+++ b/pkg/setting/setting_azure_test.go
@@ -261,6 +261,40 @@ func TestAzureSettings(t *testing.T) {
 			assert.Equal(t, "ID_2", cfg.Azure.UserIdentityTokenEndpoint.ClientId)
 			assert.Empty(t, cfg.Azure.UserIdentityTokenEndpoint.ClientSecret)
 		})
+
+		t.Run("does not enable username assertion by default", func(t *testing.T) {
+			cfg := NewCfg()
+
+			azureSection, err := cfg.Raw.NewSection("azure")
+			require.NoError(t, err)
+			_, err = azureSection.NewKey("user_identity_enabled", "true")
+			require.NoError(t, err)
+
+			cfg.readAzureSettings()
+			require.NotNil(t, cfg.Azure)
+			require.NotNil(t, cfg.Azure.UserIdentityTokenEndpoint)
+
+			assert.True(t, cfg.Azure.UserIdentityEnabled)
+			assert.False(t, cfg.Azure.UserIdentityTokenEndpoint.UsernameAssertion)
+		})
+
+		t.Run("should appropriately set username assertion", func(t *testing.T) {
+			cfg := NewCfg()
+
+			azureSection, err := cfg.Raw.NewSection("azure")
+			require.NoError(t, err)
+			_, err = azureSection.NewKey("user_identity_enabled", "true")
+			require.NoError(t, err)
+			_, err = azureSection.NewKey("username_assertion", "username")
+			require.NoError(t, err)
+
+			cfg.readAzureSettings()
+			require.NotNil(t, cfg.Azure)
+			require.NotNil(t, cfg.Azure.UserIdentityTokenEndpoint)
+
+			assert.True(t, cfg.Azure.UserIdentityEnabled)
+			assert.True(t, cfg.Azure.UserIdentityTokenEndpoint.UsernameAssertion)
+		})
 	})
 
 	t.Run("forward settings to plugins", func(t *testing.T) {