Entra ID as MFA

This guide explains how to integrate Ironchip as an external multi-factor authentication (MFA) method in Microsoft Entra ID (formerly Azure AD). Microsoft and Ironchip connect over the OIDC protocol.

Requirements

• An account with a P1 or P2 license and permissions in Azure Cloud.
• Access to the Ironchip admin console.

Configure Entra ID

Create the enterprise application

1. In Entra ID, go to Enterprise applications and add a new enterprise application.

   

2. Select Create your own application, choose a name for the application and select Integrate any other application you don’t find in the gallery.

   

   

Configure the redirect URIs

1. Go to Manage > Properties and click the application registration.

   

2. In Overview, copy the application ID. You will need it later to set up Ironchip as MFA in Azure.

3. In Endpoints, copy the OAuth 2.0 authorization endpoint (v2). It is one of the two redirect URIs you need.

4. The other redirect URI is the one that leads to the Ironchip IdP: https://idp.ironchip.com/oidc/auth.

5. Go to Authentication, select Add a platform and choose Web.

   

   

6. Add the Ironchip redirect URI first and then the Azure one.

Configure the tokens

Go to Token configuration and add the optional claims shown in the screenshot:

• login_hint, in the ID and Access token types.
• preferred_username, in the ID token type.

Configure the API permissions

Go to API permissions and add these delegated Microsoft Graph permissions, then grant admin consent:

• openid
• profile
• User.Read

Configure Ironchip

Create an application in the Ironchip admin console to connect Microsoft with Ironchip through OIDC.

1. In the Ironchip admin console, go to Applications.

   

2. Select New Application, give it a name and choose the OIDC - OAUTH 2.0 integration type.

   

3. In Redirect URIs, enter https://login.microsoftonline.com/common/federation/externalauthprovider and click Next. This URI sends the user back to Microsoft when authentication finishes.

   

4. When you finish, Ironchip shows the application credentials: Client ID, Client Secret, and Metadata URL. You need them to set up Entra ID and you can’t view them again: download them with Download or store them in a safe place.

   

Add Ironchip as an external authentication method

1. In Microsoft Entra ID, go to Manage > Security > Authentication methods.

2. Select Add external method.

   

3. On the Configure tab, fill in the method properties:

   • Name: the name of the MFA you are adding.
   • Client ID: the Client ID that Ironchip showed when you created the OIDC application.
   • Discovery Endpoint: the Metadata URL that Ironchip showed, https://idp.ironchip.com/oidc/.well-known/openid-configuration.
   • App ID: the application ID you copied from the enterprise application properties.

   

4. On the Enable and target tab, under Include, click Add target and add the users or groups that can use this MFA. The example uses a group named TestUser.

   

Configure Conditional Access

To choose which users use this authentication method, configure a Conditional Access policy.

1. Under Security, go to Protect > Conditional Access and create a new policy.

   

2. Configure the users, the resources they can access and the authentication method.

   

3. Under Access controls, go to Grant and turn on Require multifactor authentication.

   

With Conditional Access configured, authentication is enabled for the users you selected.