Introduction
This document explains how to register and configure an application in Microsoft Entra ID and enable FIDO2 (Passkey) authentication for integration with the Tenant Admin Portal.
Prerequisite
You must have Tenant Admin Access for Microsoft Entra ID.
Steps to Configure Microsoft Entra ID for Advanced User Sync
Microsoft Entra ID is configured Successfully.
Register an Application
Log in to Azure Portal and select Microsoft Entra ID on the home page.
The Microsoft Entra ID page is displayed.
Go to Overview > Manage > App registrations > New registration.
The Register an application page is displayed.
Do the following.
Enter Name.
Select Supported account types.
Note: Select Accounts in this organizational directory only.
Click Register.
The application is registered successfully.
Configure the Application
Navigate to the newly registered app > API Permissions > Add a permission > Microsoft Graph.
The Request API Permissions pop-up box is displayed.
Select Application permissions.
The List of API permissions is displayed.
Do the following:
On User drop-down, select the following:
User.Read.All
User.Read Basic.All (Optional).
On UserAuthenticationMethod drop-down, select the UsersAuthenticationMethod.ReadWrite.All
On Policy drop-down, select the following:
Policy.Read.AuthenticationMethod.
Policy.ReadWrite.AuthenticationFlows.
Click Add Permissions.
The Permissions are listed on the API.
Click Grant admin consent for Oloid inc.
The API Permissions are successfully created.
Create Client Secret
Go to Certificates & secrets > Client Secrets > + New client secret.
The Add a client secret screen is displayed.
Do the following:
Enter Description.
Select the Expires duration from the drop-down list.
Note: Select 365 days (12 months).
Click Add.
The Client Secret is added successfully and listed on Client Secret tab.
Note: Click on the Copy to Clipboard icon next to the value field to copy the secret. This option is available only at the time of creation.
Go to Overview and copy the values of Client ID and Directory (Tenant) ID.
The application is configured successfully.
Enable FIDO2 Authentication in Azure Portal
Go to Tenant Overview > Manage > Security in the vertical navigation menu.
Go to Security > Manage > Authentication Methods.
The Authentication page is displayed.
Go to Manage > Policies, select Passkey (FIDO2) in Authentication method policies table.
The Passkey (FIDO2) setting page is displayed.
Click Enable and Target tab and do the following:
Enable the toggle.
Select All User as Target.
Note: If you want all users to use FIDO2 authentication.
Click Save.
The Enable and Target tab is configured successfully.
Click Configure tab and do the following:
Select Allow Self-Service set up Yes.
Select Enforce Attestation No.
Select Enforce key restrictions No.
Select Restrict specific key Allow.
Click Save.
The Configure tab is configured successfully. FIDO2 is successfully configured.
Related Documents
Keywords
| Configure Entra ID for Advanced User Sync | Enable FIDO 2 in Entra ID |