Microsoft Entra External Authentication Method Integration

An external authentication method (EAM) lets users choose an external provider to meet multifactor authentication (MFA) requirements when they sign to Microsoft Entra ID. Incode has developed an authentication method that requires users to verify their identity as part of the login process. Requirements for this verification are configured in the Workforce Settings. This guide shows how to configure identity verification as MFA in Microsoft Entra.

Microsoft Entra Requirements

Step by step guide (Estimated setup time: 10min)

Set up Microsoft Entra Integration in Workforce Dashboard

  1. Create Microsoft Entra Integration: In your Workforce dashboard, navigate to Integrations and click New Integration. Choose Microsoft Entra integration and click Continue.
  2. Configure Integration: Give your integration a name so that you can recognize it in the Workforce Dashboard. Copy Client ID, Discovery Endpoint and Authorize Endpoint to your Microsoft Entra. Save your integration.

Set up External Authentication Method in Microsoft Entra

  1. Create Application: Go to your Microsoft Entra instance and log in as an administrator. Go to App registrations -> New registration and populate the following:

    • Name: Give a name to your application
    • Under Supported key accounts select Single Tenant
    • Under Redirect URI select Web platform and paste Authorize Endpoint as redirect URI
    • Click Register and copy its App ID

  2. Add external method: Go to Protection -> Authentication Methods -> Policies. Click + Add External Method (Preview) and fill out authenticator details. Note that this feature is only available with P1 or P2 Entra license

    • Name: Give a name to your authentication method, e.g., Incode Workforce. This is the name your users will see when selecting an authentication method during Entra login.
    • Copy Client ID, Discovery Endpoint and App ID from your Workforce integration and paste them into the respective fields.
      • An Application ID is a multitenant application from Incode, which will be used for authentication. You need to provide admin consent for this application in your tenant.

  3. Configure and Save:

    • Click Request permission to grant admin consent for Incode Workforce authenticator. Check the Consent on behalf of your organization checkbox and click Accept.
    • Toggle Enable to On.
    • Click + Add Target to select users or groups that you want to use Incode Workforce authenticator as an external authentication method. By default, the policy applies to all users.
    • Click Save

Learn more