> For the complete documentation index, see [llms.txt](https://docs.fortifiedid.se/use-cases/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.fortifiedid.se/use-cases/misc/microsoft-entra/protect-entra-id-azure-ad-with-eid-mfa.md). # Protect Entra ID (Azure AD) with eID MFA ## Scenario In this scenario, Entra ID (formerly known as Azure Active Directory), use Integrity as an EAM (external authentication method). With this setup, it's possible to use eIDs such as BankID, SITHS, EFOS, Freja, Norwegian ID-porten, Foreign eID (eIDAS) or Suomi.fi to perform MFA authentication to Entra. With this setup, it is also possible to use eIDs to fulfill Entra Conditional Access policies. In the use case described below, BankID is used as the eID method. Integrity will perform a lookup against Entra to get the value of the mfa identifier (such as social security number). The identifier of the result of the BankID authentication will be compared to the mfa identifier value, to verify that the step-up was performed by the correct person. **! This scenario could easily be copied and modified to fulfill:** * **Using other eID methods for MFA, such as SITHS, EFOS, Freja, Norwegian ID-porten, Foreign eID (eIDAS) or Suomi.fi**
## Prerequisite There are some prerequisite for this use case. You will need the following: * **BankID certificate**. To be able to communicate with bankid backend. * **Entra ID (Azure AD) administration rights. Azure P1 license, or higher.** * **Host (DNS) name** of the Integrity service (external access) * **Social security number (personnummer)** stored on the Entra ID user object. The attribute name holding the value is also required. * **Outgoing TCP/443 communication.** To be able to communicate with BankID backend and Entra ID services. ## Configuration ### Download and extract configuration files 1. Open the folder where you have installed Web 1. Rename the customer folder to **customer\_OLD**.\ Result should look like below:\ \&#xNAN;**\\..\FortifiedID\web\customer\_OLD** 2. Download the following ZIP-file, [use\_case\_entra\_mfa\_bankid.zip](https://share.fortifiedid.se/index.php/s/PsMncAsgrCGiRmC/download). 1. Unzip the file 2. Copy the **customer\_WEB** folder to **\\..\FortifiedID\web\\** 3. Rename customer\_WEB to customer, result should look like:\ \\..\FortifiedID\web\customer ### Update configuration to map your environment #### Globals In this section we will look at parts of the configuration and add/replace data for your environment. In this use case we are using the globals concept which is using variables to easily replace data specific to an environment or if a value is used in many places just update it in one place. First of all, open the file customer/config/globals.json. Change according to the instructions below. 1. **base\_dir** 1. base\_dir is the top folder where data is located that you do not want to be overwritten by an upgrade. Update the **base\_dir** folder to map your installation. 1. For Windows the value should be:\ "base\_dir": "../customer" 2. For Docker, the value should be:\ "base\_dir": ".", ```json "base_dir": "../customer" ``` 2. **host**\ Set the host value to your DNS name entry, including https\://.\ Set the oidc\_op\_address to the same value ```json "host": "https://be4f-194-68-171-97.ngrok-free.app", . . . "oidc_op_address": "https://be4f-194-68-171-97.ngrok-free.app" ``` 3. **http** Update the http information to map your environment. This is the port that Integrity Web will use to host the SAML IdP service.\ ! The recommendation is to always use SSL to encrypt the communication to Integrity Web.
```json "http": { "http_port": 443, "http_use_ssl": true } ``` 4. **keystore - https** Either you use the test certificate provided by us, if so you do not need to change anything. If you have a keystore then update the values below to point to your keystore. 1. Find in section: **keystore** 
"https": {
                      "ref": {
                          "path": "${globals.base_dir}/config/resources_internal/certificates/fortifiedid.p12",
                          "password": "password"
                      },
                      "http_key_alias": "1",
                      "http_key_password": "password"
                  },
5. **keystore - bankid** For connecting against BankID test environment, you don't need to do anything.\ For production connectivity, please use your BankID keystore and change the variables below to reflect that. Truststore changes will not be needed.\ Find in section: **keystore**
```json "bid": { "ssl_keystore_path": "${globals.base_dir}/config/resources_internal/certificates/BankID/bankid_test_rp.p12", "ssl_keystore_password": "qwerty123", "ssl_key_alias": "1", "ssl_key_password": "qwerty123", "ssl_truststore_path": "${globals.base_dir}/config//resources_internal/certificates/trust_jks/bankidtrust.jks", "ssl_truststore_password": "password" }, ``` 6. **keystore - entra**\ The keystore used for connecting to Entra ID, to perform a user lookup.\ For test environments, you may use the test certificate provided by us, if so you do not need to change anything.\ For production environments, you should use your own keystore and update the values below to point to that keystore.
            "entra": {
                   "ssl_keystore_path": "${globals.base_dir}/config/resources_internal/certificates/fortifiedid.p12",
                   "ssl_keystore_password": "password"
               },
7. **keystore - oidc**\ The keystore used to sign OpenID Connect tokens.\ For test environments, you may use the test certificate provided by us, if so you do not need to change anything.\ For production environments, you should use your own keystore and update the values below to point to that keystore.
```json "oidc": { "alias": "1", "key_password": "password", "password": "password", "path": "${globals.base_dir}/config/resources_internal/certificates/fortifiedid.p12" } ``` 8. **entra**\ The global settings for Entra will be added in a later step. Save the globals.json file. ### Start the Integrity WEB service Start the service and verify the start by looking through the server.log file. ### Add Integrity as an Entra external authentication method (EAM) #### Create App Registration * Login to Entra ID as an administrator * Select *App Registrations* * Click *New Registration* * Enter a name of the app registration, *BankID EAM* * Select *Accounts in this organizational directory only (\ only - Single tenant)* * Add a redirect uri * Platform = *web* * Value = ** * Change HOST to your DNS host name entry for Integrity. * *Register* * Click on the App Registration in the list * Select *API permissions* * Add these permissions: * In the *Overview* section, copy these values (they will be used in later steps): * Application (client) ID * Object ID * Directory (tenant) ID * Extract the certificate chain from the keystore file referenced in the globals entra->ssl\_keystore\_path, [using this guide](https://docs.fortifiedid.se/solutions/pki/extract-certificate-chain-from-keystore). This should result in a certificate file that will be used in next step. * Select *Certificates & secrets* * Select *Certificates* * Click *Upload certificate* * Select the certificate file * Click *Save* #### Add external authentication method * Select *Authentication methods* * Click *Add external method* * Enter: * Name = BankID * Client ID = entra\_mfa\_client * Discovery endpoint = * Change HOST to your DNS host name entry for Integrity. * App ID = \ * Save * Grant admin consent * Enable the external authentication method.\ For testing purposes, it is recommended to set the target only to specific test users. ### Update Integrity with Entra ID values * Open the file customer/config/globals.json. Change according to the instructions below. 1. **entra**\ Set client\_id = Application (client) ID copied in previous step\ Set tenant\_id = Directory (tenant) ID copied in previous step\ Set mfa\_identifier\_attribute = The Entra user object attribute containing the social security number of the user.\ \ Example: ```json "entra": { "client_id": "3d970wwc4-cb9c-yyy-xxx-55f574a7ae41", "tenant_id": "bf70sas0ec-fsad-456g-345-dfgdfgd43", "mfa_identifier_attribute": "extensionAttribute13" }, ``` * Save the file * Restart the Integrity service ## Test the configuration ### Login to an Entra resource with BankID as the MFA method * Open a browser * Browse to a Azure resource which require MFA (such as portal.azure.com) * Enter your Entra username and password * You should now be prompted to fulfill MFA with an external method. Example: * You should be redirected to Integrity and then to Entra * Fulfill BankID authentication * You should now be redirected back to Entra. If successful, you have successfully fulfilled the MFA requirement and the Azure resource is presented.