Configure OpenID Connect identity provider in Microsoft Entra external ID

Introduction to Microsoft Entra External ID

Importance of Social and Corporate Account Integration

• Enabling sign-in through social and corporate accounts enhances user experience and streamlines authentication processes.

• Users can access applications using existing credentials, leading to higher conversion rates and improved satisfaction.

Overview of Microsoft Entra External ID

Features of Microsoft Entra External ID

• Allows users to authenticate using social accounts from providers like Facebook, Google, and Apple ID.

• Organizations can configure custom identity provider federation for both social and corporate identities.

Demonstration Setup

Wood Groceries Live Demo Application

• The demo uses a fictitious online grocery store integrated with Microsoft Entra external ID.

• Users select the "Microsoft personal account" option to begin the sign-in process.

Sign-In Flow Process

User Authentication Steps

• After selecting the identity provider, users are directed to the live.com sign-in page.

• First-time users may need to grant permission for data sharing (e.g., display name, email).

Completing Registration

Post Authentication Details

• Users return to complete registration in Microsoft Entra external ID without needing a password.

• An external account is created linked to the user's unique identifier from the identity provider.

Accessing Wood Groceries Application

Security Token Insights

• Upon signing in, users can view security token content showing claims like provider issuer name (IDP).

Configuring Custom OpenID Connect Identity Providers

Steps for Configuration

• Register an application within the identity provider service to establish trust with Microsoft Entra external ID tenant.

Application Registration Requirements

Key Details Needed for Registration

• Important details include application name, icon link, privacy policy URL, and redirect URIs.

Understanding Well-Known Configuration Metadata Document

Importance of Metadata Document

• Contains crucial information about the identity provider such as issuer name and token endpoints.

Configuring OpenID Connect Provider in Microsoft Entra

Redirect URI Construction

• Collect necessary information from your Microsoft Entra admin center for constructing redirect URIs.

Registering Applications with Identity Provider Service

Live.com Example

• Register an application within live.com while signed into your entry ID workforce account.

• Record client IDs needed for configuration later on.

Configuring Claims in Tokens

Adding Optional Claims

• Select claims like email or family name during token configuration; ensure required permissions are granted automatically.

Finalizing Identity Provider Configuration

Adding New OpenID Connect Federation

• Enter details such as display name and well-known endpoints in your tenant's settings.

Integrating Identity Provider into User Flows

User Flow Addition Steps

• Add new open ID connect identity provider under user flows settings; test by running user flow options.

Conclusion on Benefits of Using Microsoft Entra External ID

Simplifying Authentication Processes

• One trusted identity provider simplifies federation processes across various applications without requiring changes when adding new providers.