Skip to content
English
  • There are no suggestions because the search field is empty.

How do set-up SurePassID MFA for Entra ID

 1. What / Why (30-second version)
  • What: EAM lets Entra ID delegate the MFA challenge to SurePassID over OpenID Connect. Entra stays the primary IdP; SurePassID is the MFA authority.
  • Why: Reuse existing SurePassID authenticators (OTP hardware tokens, FIDO2/passkeys, push, SMS/voice) as the Entra second factor without re-issuing credentials or running two MFA systems.
  • Trigger: An Entra Conditional Access policy that requires MFA for the targeted users/apps invokes the external method.
  • Direction: This configures inbound trust — Entra is the client, SurePassID validates Entra's signed request object.
2. Prerequisites
Need Detail
Entra role Authentication Policy Administrator or Global Administrator
SurePassID role Account Admin (tenant) or Super Admin
SurePassID tenant Domain-scoped eam/{domain}/* endpoints reachable over HTTPS
Entra tenant id Directory (tenant) GUID from your Entra app registration
DB schema mfa_db_update.sql applied (creates EamConfig and OIDC tables)
3. Values you'll exchange
Value Set in Entra Set in SurePassID Notes
Client Id (app id) ✔ (App/Client ID) ✔ (Client Id (token aud)) Must match on both sides; becomes token aud.
Discovery endpoint ✔ (points at SurePassID) — SurePassID's oidc/{domain}/.well-known/openid-configuration.
Entra OpenID Config URL — ✔ https://login.microsoftonline.com/{tenant-id}/v2.0/.well-known/openid-configuration.
Redirect URI (fixed MS endpoint) ✔ (from Cloud Environment) .../common/federation/externalauthprovider.
ACR policy assurance ✔ (possessionorinherence default) Must align with the CA policy requirement.
Client Secret (optional) ✔ ✔ (Set/Clear, write-only) Masked; never re-displayed.
4. Cloud environment reference
Cloud Entra OpenID Config URL template Redirect URI
Azure Commercial https://login.microsoftonline.com/{tenant-id}/v2.0/.well-known/openid-configuration https://login.microsoftonline.com/common/federation/externalauthprovider
Azure Government https://login.microsoftonline.us/{tenant-id}/v2.0/.well-known/openid-configuration https://login.microsoftonline.us/common/federation/externalauthprovider
Azure Government (DoD) https://login.microsoftonline.us/{tenant-id}/v2.0/.well-known/openid-configuration https://login.microsoftonline.us/common/federation/externalauthprovider

Selecting the Cloud Environment dropdown on the EAM page auto-fills the config URL template and redirect URI; both stay editable. Replace {tenant-id} with your Entra directory GUID.

5. ACR values
ACR Meaning
possessionorinherence (default) Possession or biometric/inherence factor satisfies MFA.
possession Possession factor required (e.g., OTP token, push).
inherence Biometric/inherence factor required.
mfa Full multi-factor required.

Pick the value that matches what your Entra Conditional Access policy demands.

6. Step-by-step integration

A. Register the app in Entra ID (get the Tenant Id + Client Id first)

Do this first — it produces the Tenant (Directory) Id and Client (Application) Id that both later sections require (see B.3 and B.5).

  1. Sign in to the Microsoft Entra admin center as an Application Administrator / Global Administrator.
  2. Go to Identity → Applications → App registrations → New registration.
  3. Give it a Name (e.g., SurePassID EAM) and register it.
  4. On the app's Overview blade, copy and record:
    • Application (client) ID → use as the Client Id (token aud) in B.3.
    • Directory (tenant) ID → substitute for {tenant-id} in B.5.
  5. (If using a shared secret) under Certificates & secrets → New client secret, create a secret and record its value for later (C.4).

B. In SurePassID (clientcustomizesso.aspx → EAM Configuration)

  1. Open Customize SSO for the tenant, click EAM Configuration.
  2. Set Enabled = yes.
  3. Enter Client Id (token aud) — the Application (client) ID from A.4.
  4. Choose Cloud Environment (auto-fills config URL + redirect URI).
  5. Replace {tenant-id} in Entra ID OpenID Config URL with the Directory (tenant) ID from A.4 (use the help ✔ icon to see where it lives in Entra).
  6. Confirm/adjust Redirect URI and pick the ACR.
  7. (Optional) Set a Client Secret (write-only; Set/Clear) matching A.5.
  8. Click Save. Confirm the Last Updated timestamp changes.

C. In Microsoft Entra admin center (add the external method)

  1. Sign in as Authentication Policy Admin / Global Admin.
  2. Go to Protection → Authentication methods → Add external method.
  3. Enter a Name, the Client ID (same as A.4 / B.3), and the Discovery endpoint = SurePassID oidc/{domain}/.well-known/openid-configuration.
  4. (If used) enter the matching Client Secret from A.5.
  5. Target the users/groups that should use SurePassID for MFA.
  6. Enable the method.
  7. Ensure a Conditional Access policy requires MFA for those users/apps.

D. Validate

  1. Sign in as a pilot user to an Entra-protected app.
  2. Confirm redirect to SurePassID for the second factor.
  3. Complete MFA and confirm sign-in succeeds.
  4. Check the SurePassID audit trail for the EAM authentication record.
7. Troubleshooting
Symptom Likely cause Fix
Entra never redirects to SurePassID CA policy not requiring MFA, or method not targeted/enabled Verify CA policy scope; enable + target the external method.
"Invalid audience" at SurePassID Client Id mismatch Ensure the Entra App ID equals the EAM Client Id (token aud).
Discovery/JWKS failure Wrong config URL or unreachable endpoint Check {tenant-id} substitution and HTTPS reachability.
Redirect rejected Redirect URI mismatch Use the exact externalauthprovider URI for the correct cloud.
Assurance not accepted ACR mismatch Align EAM ACR with the CA policy requirement.
Secret errors Secret set on one side only Set the same secret on both sides, or clear both.
8. Security reminders
  • Client Secret is write-only in the UI and stored encrypted/hashed — never rendered back or placed in view state.
  • EAM config is single-row per tenant and tenant-scoped; cross-tenant access is denied.
  • Every create/edit/secret-change writes an admin audit record.

Field names and menu paths in the Entra admin center change over time — confirm against Microsoft's current "external authentication methods" documentation if wording differs.