Entra ID: External MFA

Microsoft External MFA (formerly External Authentication Methods) in Microsoft Entra ID allows organizations to integrate their preferred multifactor authentication (MFA) solutions directly with Entra ID.

Prerequisites

Integrating TrustBuilder as an External MFA in EntraID requires the following:

Licensing

At least a Microsoft Entra ID P1 license.

User provisioning

Users must be synchronized from Microsoft Entra ID to TrustBuilder.
The Microsoft Entra ID objectId must be mapped to the TrustBuilder oid attribute. The mapping procedure depends on the provisioning method used.

For SCIM provisioning, see Entra ID: SCIM + External MFA.

Specific case of local applications on Windows

Check the status of WebView2 Runtime:

Verify it is present (check Settings > Apps > Installed apps for “Microsoft Edge WebView2 Runtime”). If it is missing, deploy it using the Evergreen Standalone Installer from Microsoft.

Enable WebView2 in the Entra ID plugin:

Configure a registry entry with:

Reg key location: Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\AAD
Reg key value: WebView2Integration as a DWORD and assign it to “1” for WebView2 integration to be ON.
Note: If the AAD key does not exist, create it by right-clicking on Windows, selecting New > Key, and naming it AAD.

More information: Modernizing Microsoft Entra ID auth flows with WebView2 in Windows 11

Integration Steps

Step 1 - Configure an application in TrustBuilder

Create and configure an application in TrustBuilder:

1. Log in to TrustBuilder administrator portal.

2. Go to Integrations > Applications > + Set up app integration.

3. Select OIDC.

   

4. In General section, enter a name and optionally a description and a logo.

5. Choose the application type Public Application.

6. Click on Next.

7. For the subject, select oid (see Prerequisites). TrustBuilder will use the oid to check if the user exists.

   

8. Select the API scope. You can select Internal API. No additional scopes are needed for this integration: the default openid scope is sufficient.

9. Enter the following redirect URI: https://login.microsoftonline.com/common/federation/externalauthprovider

10. Select:

    1. the authorization policy → you can choose the default built-in policy. This policy requires users to be authenticated with an authentication method meeting AAL3 level.

    2. the JWT Signature Algorithm → Microsoft wants a certificate SHA256 or EC256.

11. Click on Submit.

12. Click on Done.

    

    The main configuration is complete.

13. In the General tab, disable PKCE.

    

14. In the Security settings tab, in Allowed Origins parameter, enter the URL where the authentication requests originate from.
    - For web applications a usual value should be: https://login.microsoftonline.com.
    - For desktop applications, you can keep the default value *.

    

15. In the Endpoints tab, you will find the OAuth Authorization URL. Copy it as you will need this information in Entra ID to connect the application to TrustBuilder.

    

Step 2 - Register an application in Entra ID

Register an application in Entra ID and connect it to TrustBuilder:

1. Log in to Microsoft Entra admin center.

2. Go to App registration > + New registration.

   

3. Define a name and set the supported account types to "Accounts in any organizational directory (Any Entra ID directory - Multitenant)".

   

4. In the Redirect URI section:

   • Select Web platform,

   • Paste the Authorization endpoint previously copied from Trustbuilder.

     
     

5. Click on Register.

6. Once the app is created in Entra ID, you will find information in the Essentials section.
   Keep the Application (client) ID handy, as you'll need it later to configure your External MFA.

   

Step 3 - Add TrustBuilder as an External MFA in Entra ID

In Microsoft Entra admin center:

1. Go to Authentication methods > Policies.

2. Click on + Add external MFA.

3. Set parameters for TrustBuilder authentication method:

   1. Name: Enter a name for TrustBuilder authentication method.
      ⚠️ Users will see this name when they select their authentication method during Entra ID login. Choose a name that is clear and recognizable to them. It cannot be changed.

      

   2. Client ID: Paste the Client ID of your TrustBuilder OIDC application.

      

   3. Discovery Endpoint: Paste the Well-Known URL of your TrustBuilder OIDC application.

      

   4. App ID: Paste the Application ID value of your app in Entra ID.
      (To retrieve the Application ID go to App registrations > All applications > Application (client) ID column)

   5. Request admin consent: Click on “Request permission” to request for admin consent to be granted to the application so that they can read the required info from the user to authenticate correctly.
      You are prompted to sign in with an account with admin permissions and grant the provider’s application with the required permissions. After you grant admin consent and the change replicates, the page refreshes to show that admin consent was granted.

      

4. Check the included and excluded targets. All users are included by default.

5. Enable the TrustBuilder External MFA.
   If you want to enable only the newly created authentication methods, make sure the 'built-in' methods are disabled (in Authentication Methods > Policies).

   

6. Save the configuration.

Step 4 - Configure a conditional access policy in Entra ID

In Microsoft Entra admin center:

1. Go to Conditional Access > Policies.

2. Click on + New Policy (or edit an existing one).

   • Enter a name

   • Specify the users that will be covered by this policy.

   • Specify the target applications.

   • Specify the access that should be granted.
     In our case, check Require multifactor authentication. Thus, our External MFA will be used as a MFA step.

     

3. Enable the policy.

   

4. Click on Create.

Troubleshooting

AADSTS5001258: Failed to validate external id_token: 'acr' claim has unexpected value.
There two possible cases:

1. This error happens when the connector has been modified or when the external authentication method has been modified. Solution: wait some time and retry. The error should disappear.

2. Check the Connector type. It it is OIDC, create a OIDC Azure AD connector and use it instead.

Related documentations

• How to manage an external authentication method in Microsoft Entra ID - Microsoft Entra ID

• Use Microsoft Entra MFA with an external MFA provider