Microsoft Entra external authentication method

Microsoft Entra ID can use this service as an additional factor after signing in at Microsoft (external authentication method, EAM). The person signs in at Microsoft as usual and Entra sends them here to confirm with a passkey. It is the alternative to federation for domains that stay managed by Microsoft. Entra's behaviour comes from Microsoft's documentation and must be tested in a test tenant.

Federation or external method?

Do not use both for the same people.

What is needed?

• An Entra directory connector, to know which person here matches the person Entra sends. The operations team installs it.
• A policy rule that allows federation.authorize for this service.

How do I set it up?

1. Under «Manage» › «OIDC services», choose «New service» with the Microsoft Entra type, the redirect URI https://login.microsoftonline.com/common/federation/externalauthprovider, the «Entra tenant (UUID)» and the «Directory connector (UUID)». Choose «Save service».
2. In the Entra admin center, add an external authentication method with the discovery document https://<organization address>/.well-known/openid-configuration and the «Service identifier» as the application identifier.
3. Apply the method to a pilot group and test with one person.

Limits

Passkey only: phone approval is refused («This service requires a passkey sign-in.») and single sign-on is not used. The person must be exactly the one Entra named.

Problems