# Entra ID as MFA

> Use Ironchip as an external multi-factor authentication method in Microsoft Entra ID through OIDC and require it with a Conditional Access policy.

URL: https://docs.ironchip.com/en/identidad/integraciones/saas/entra-id-mfa/

This guide explains how to integrate Ironchip as an external multi-factor authentication (MFA) method in Microsoft Entra ID (formerly Azure AD). Microsoft and Ironchip connect over the OIDC protocol.

## Requirements

- An account with a P1 or P2 license and permissions in Azure Cloud.
- Access to the Ironchip admin console.

## Configure Entra ID

### Create the enterprise application

1. In Entra ID, go to **Enterprise applications** and add a new enterprise application.

   [Image: Enterprise applications list in Entra ID with the new application button]

2. Select **Create your own application**, choose a name for the application and select **Integrate any other application you don't find in the gallery**.

   [Image: Create your own application window with the application name]

   [Image: Option to integrate any other application you don't find in the gallery]

### Configure the redirect URIs

1. Go to **Manage** > **Properties** and click the application registration.

   [Image: Enterprise application properties with the link to the application registration]

2. In **Overview**, copy the application ID. You will need it later to set up Ironchip as MFA in Azure.
3. In **Endpoints**, copy the **OAuth 2.0 authorization endpoint (v2)**. It is one of the two redirect URIs you need.
4. The other redirect URI is the one that leads to the Ironchip IdP: `https://idp.ironchip.com/oidc/auth`.
5. Go to **Authentication**, select **Add a platform** and choose **Web**.

   [Image: Authentication menu with the Add a platform option]

   [Image: Web platform selection]

6. Add the Ironchip redirect URI first and then the Azure one.

### Configure the tokens

Go to **Token configuration** and add the optional claims shown in the screenshot:

- `login_hint`, in the **ID** and **Access** token types.
- `preferred_username`, in the **ID** token type.

[Image: Token configuration with the optional claims login_hint (ID and Access) and preferred_username (ID)]

### Configure the API permissions

Go to **API permissions** and add these delegated Microsoft Graph permissions, then grant admin consent:

- `openid`
- `profile`
- `User.Read`

[Image: Delegated Microsoft Graph permissions openid, profile and User.Read with consent granted]

## Configure Ironchip

Create an application in the Ironchip admin console to connect Microsoft with Ironchip through OIDC.

1. In the Ironchip admin console, go to **Applications**.

   [Image: Ironchip admin console side menu with Applications selected]

2. Select **New Application**, give it a name and choose the **OIDC - OAUTH 2.0** integration type.

   [Image: Ironchip applications list with the New Application button]

3. In **Redirect URIs**, enter `https://login.microsoftonline.com/common/federation/externalauthprovider` and click **Next**. This URI sends the user back to Microsoft when authentication finishes.

   [Image: Add new application form with the OIDC - OAUTH 2.0 type and the Microsoft redirect URI]

4. When you finish, Ironchip shows the application credentials: **Client ID**, **Client Secret**, and **Metadata URL**. You need them to set up Entra ID and you can't view them again: download them with **Download** or store them in a safe place.

   [Image: Credentials of the new application in Ironchip: Client ID, Client Secret and Metadata URL]

## Add Ironchip as an external authentication method

1. In Microsoft Entra ID, go to **Manage** > **Security** > **Authentication methods**.
2. Select **Add external method**.

   [Image: Authentication methods with the Add external method option]

3. On the **Configure** tab, fill in the method properties:
   - **Name**: the name of the MFA you are adding.
   - **Client ID**: the **Client ID** that Ironchip showed when you created the OIDC application.
   - **Discovery Endpoint**: the **Metadata URL** that Ironchip showed, `https://idp.ironchip.com/oidc/.well-known/openid-configuration`.
   - **App ID**: the application ID you copied from the enterprise application properties.

   [Image: External method properties with the name, client ID, discovery endpoint, and app ID]

4. On the **Enable and target** tab, under **Include**, click **Add target** and add the users or groups that can use this MFA. The example uses a group named `TestUser`.

   [Image: Include tab of the external method with the TestUser group as a target]

## Configure Conditional Access

To choose which users use this authentication method, configure a Conditional Access policy.

1. Under **Security**, go to **Protect** > **Conditional Access** and create a new policy.

   [Image: Conditional Access section with the new policy button]

2. Configure the users, the resources they can access and the authentication method.

   [Image: User and resource settings of the Conditional Access policy]

3. Under **Access controls**, go to **Grant** and turn on **Require multifactor authentication**.

   [Image: Require multifactor authentication option under Grant]

With Conditional Access configured, authentication is enabled for the users you selected.