What is a ForgeRock AM Realm and what is it used for?

A Realm in ForgeRock AM is an administrative boundary that provides isolated configuration of identity stores, authentication trees, OAuth2 providers, policies, and agents. Every AM installation has a top-level root realm (denoted /), and administrators can create any number of sub-realms underneath it. Each realm operates as a logically independent IAM domain within the same AM deployment.

Realms are used primarily for multi-tenancy. Consider a large organisation with separate business units — HR, Finance, and Customer Portal — each needing its own identity store, its own authentication policies, and its own set of OAuth2 clients. Rather than deploying three separate AM instances, you create three realms. Configuration in one realm has zero visibility into another, even though they share the same AM infrastructure and CTS token store.

Concrete things that are configured per-realm:

• Identity data stores (which LDAP directory or DS instance backs users in this realm)
• Authentication trees and chains
• OAuth2 provider settings (issuer, token lifetimes, JWKS endpoint)
• SAML2 entity providers
• Policy sets and policies
• Agent profiles (Java agents, Web agents, IG agents)
• Password policies

DNS aliases can be mapped to specific realms so that hr.example.com/login routes automatically to the HR realm and finance.example.com/login routes to the Finance realm. This is done through the realm's DNS aliases configuration. Users in different realms are completely separate identity populations — a user object in the HR realm and a user object with the same username in the Finance realm are distinct entities.