Entra ID external authentication method

If you want to connect PingOne as the external authentication provider for multi-factor authentication (MFA) in Entra ID, you need to add a Microsoft identity provider (IdP).

Before you begin

Make sure you have a PingOne organization and an environment with PingOne SSO and PingID added. Create a new environment as follows, depending on whether you’re already using PingID:

If you aren’t using PingID already or if you want to create a new PingID account, create a new PingID environment in PingOne.
If you’re using PingID currently and want to use your existing PingID account, integrate a PingID account with a new PingOne account. You should also follow these steps if you’ve previously integrated PingID with Microsoft Entra ID using custom controls. Learn more about integrating PingID with Entra ID in the PingID documentation.

New PingID accounts: Creating a population for Microsoft Entra ID users

If you created a new PingID environment in PingOne, your new environment includes a population named Default. Learn more in Creating a new PingID environment in PingOne.

If you integrated an existing PingID account with a new PingOne account, skip to Existing PingID accounts: Creating a population for Microsoft Entra ID users and changing the default population.

A screen capture of the Populations page with one Default environment.

When you configure an EAM for Microsoft Entra, you’ll need to create a new population in PingOne for users coming from Entra ID.

Steps

Go to Directory > Populations.
Click the icon to add a new population.
Enter the following:
1. Population Name: A unique label for the population, such as Entra ID users.
2. Description (optional): A brief description of the population.
3. Default Population (optional): Do not click this checkbox in this scenario unless you want to specify this population as the new default population.
Click Save.

Existing PingID accounts: Creating a population for Microsoft Entra ID users and changing the default population

If you integrated your PingID account with a new PingOne account, your new environment includes a population named Default with users from PingID assigned to this population. The following image shows the Default population with two users from PingID.

If you created a new PingID environment in PingOne, follow the steps in New PingID accounts: Creating a population for Microsoft Entra ID users.

A screen capture of the Populations page with one Default environment that has two identities.

By default, the Identity Provider for this population is set to PingOne. You’ll update this setting as part of this process.

A screen capture of the Populations page with the Default population selected and the details panel showing.

Because you could have a future scenario where users in this environment aren’t coming from Microsoft Entra ID, you should rename the Default population, create a new population for users coming from Entra ID, and set the new population as the default population.

Steps

Go to Directory > Populations.
Click the Default population, and then click the Pencil icon to edit the population.
Change Population Name from Default to a new name, such as Entra ID users.
Click Save.
To create a new population, click the icon.
Enter the following:
1. Population Name: A unique label for the population, such as Home.
2. Description (optional): A brief description of the population.
3. Default Population: Click the Enable checkbox to set this population as the new default population.
4. In the confirmation modal, click Confirm to make this population the new default population.
Click Save.

Result

You now have two populations in your environment:

Entra ID users: Users from PingID are assigned to this population. This is also the population where future Entra ID users will be assigned when Entra ID redirects users to PingOne for MFA. This population was previously named Default and was previously set as the default population.
Home: This population is the new default population and was created for future scenarios where users are not coming from Entra ID.

A screen capture of the Populations page with two populations: Entra ID users and Home.

Registering your application with Microsoft

To configure an EAM, register an application in Microsoft Entra. Learn more in Quickstart to registering an app in the Microsoft Entra documentation.

Before you begin

Ensure that you have:

A Microsoft Entra account with an active subscription
An Entra tenant

Steps

Go to the Microsoft Entra admin center.

If you don’t have a Microsoft Entra account, you can create one now.
On the left, expand Identity > Applications.
Click App registrations.
At the top, click New registration.
In the Name field, enter a user-facing display name for the application.
For Supported account types, select Accounts in this organizational directory only (Ping Identity only - Single tenant) or Accounts in any organizational directory and personal Microsoft accounts, depending on the needs of your organization.

Select the Single tenant option if you’re working with only identities from your environment.
Under Redirect URI, select Web as the platform and enter the authorization URL of your PingOne environment.

You can find this URL on the Configuration tab of any OpenID Connect (OIDC) application in the PingOne admin console, in the URLs section.

The format is <issuer>/authorize.

Example 1: https://auth.pingone.<region>/<envID>/as/authorize

Example 2: https://<customDomain>/as/authorize if you set up a custom domain. Learn more in Setting up a custom domain.
Click Register.

Enabling the implicit grant

After registering an application in Entra, enable the implicit grant type for your application to support an EAM.

Steps

Go to the Microsoft Entra admin center.
In the App registrations section, select your application.
Go to Manage > Authentication.
In the Implicit grant and hybrid flows section, select the ID tokens checkbox.
Click Save.

Getting the client ID and client secret for your application and the tenant ID of your Entra tenant

When you register your application with Microsoft, Microsoft generates an application (client) ID and application secret for the application.

Microsoft also generates a directory (tenant) ID for each Microsoft Entra tenant. You’ll copy these values and enter them into PingOne.

Steps

Go to the Microsoft Entra admin center.
In the App registrations section, select your application.
On the left, click Certificates & secrets.
In the Client secrets section, click New client secret.
Enter the following:
1. Description: A brief characterization of the client secret.
2. Expires: Select the duration of the certificate, based on the needs of your organization.
Click Add.
In the Client secrets section, locate the value for the applicable secret and copy it to a secure location.
On the left, click Overview.
Locate the Application (client) ID and copy it to a secure location.
Locate the Directory (tenant) ID and copy it to a secure location.

Setting up API permissions

Using an EAM with Microsoft Entra requires certain API permissions that you’ll need to enable in your application.

Steps

Go to the Microsoft Entra admin center.
In the App registrations section, select your application.
On the left, click API permissions.
Click Add a permission.
Click Microsoft Graph.
Click Delegated permissions and expand Openid permissions.
Select the openid and profile permissions.

User.Read is included by default and should remain selected.

Click Application permissions, expand User, and select the User.Read.All permission.

If you don’t intend to retrieve many attributes from Microsoft Entra ID and populate them into PingOne, you can select the User.ReadBasic.All permission instead of the User.Read.All permission.

Both of these permissions require admin consent.

To grant admin consent, click Add permissions.
Click Grant admin consent for <your Entra tenant>.

Adding Microsoft as an identity provider in PingOne

Configure the IdP connection in PingOne.

Steps

In PingOne, go to Integrations > External IdPs.
Click Add Provider.
Click Microsoft.
On the Create Profile page, enter the following information:
- Name: A unique identifier for the IdP.
- Description: (Optional). A brief description of the IdP.
You cannot change the icon and login button, in accordance with the provider’s brand standards.
Click Continue.
On the Configure IDP Connection page, enter the following information:
- Client ID: The application ID from the IdP that you copied earlier. You can find this information on the Microsoft Entra admin center.
- Client secret: The application secret from the IdP that you copied earlier. You can find this information on the Microsoft Entra admin center.
- Tenant ID: The tenant ID of your Entra tenant that you copied earlier. You can find this information on the Microsoft Entra admin center.
Click Save and Continue.
On the Map Attributes page, define how the PingOne user attributes are mapped to IdP attributes. Learn more in Mapping attributes.
- Leave the default PingOne user profile attributes and the external IdP attributes:
  - Preferred Username (from Microsoft) as the source of the PingOne Username
  - Email (from Microsoft) as the source of the PingOne Email Address
- To add an attribute, click Add attribute.
- To use the expression builder, click Build and test or Advanced Expression. Learn more in Using the expression builder.
- Select the update condition, which determines how PingOne updates its user directory with the values from the IdP. The options are:
  - Empty only: Update the PingOne attribute only if the existing attribute is empty.
  - Always: Always update the PingOne directory attribute.
Click Save & Finish.
Click the connection in the Identity Providers list to expand the connection details.
Click the Registration tab, and then click the Pencil icon.

For Population, select the population that you previously created for Entra ID users.

If you created a new PingID environment in PingOne, use the population that you created in New PingID accounts: Creating a population for Microsoft Entra ID users.
If you integrated your PingID account with a new PingOne account, use the population that you created in Existing PingID accounts: Creating a population for Microsoft Entra ID users and changing the default population.

Click Save.

A screen capture of the Microsoft Identity Provider connection with the Entra ID users population selected.

Updating the population

After creating your connection to Microsoft, update the Identity Provider setting for the population that you created for users coming from Entra ID.

The Identity Provider setting is used as the runtime fallback IdP for users in the population who do not have an authoritative IdP configured in their user profile. Updating the population is especially important if you integrated your PingID account with a new PingOne account because those user profiles are created in PingOne without an authoritative IdP set. If the user is removed from the population, the IdP set in the population no longer applies to them.

Steps

Go to Directory > Populations.
Click the population that you previously created for Entra ID users.
Click the Pencil icon.
In the Identity Provider list, select the IdP that you previously created in Adding Microsoft as an identity provider in PingOne.
Click Confirm in the modal, and then click Save.

Adding the callback URL to the Microsoft Entra admin center

If you created an authentication policy for OIDC authentication, you must also add the callback URL from the Microsoft IdP connection to the application you registered in the Microsoft Entra admin center.

Steps

In PingOne, go to Integrations > External IdPs.
Locate the Microsoft IdP that you created previously and then click the Details icon to expand the IdP.
Click the Connection tab.
Copy the Callback URL.

The following examples show the URL format:

Example 1: https://auth.pingone.<region>/<envID>/rp/callback/microsoft

Example 2: https://<customDomain>/rp/callback/microsoft
Go to the Microsoft Entra admin center.
In the App registrations section, select your application.
On the left, click Authentication.
Go to Platform configurations > Web > Redirect URIs, and click Add URI.
Paste the Callback URL that you copied from PingOne.
Click Save.

Next steps

Enable the Microsoft IdP.
Add the Microsoft IdP to an authentication policy followed by an MFA step. Learn more in Adding an external identity provider sign-on step.
Add an OIDC application in PingOne and assign the authentication policy to your application. Learn more in Editing an application for the Microsoft Entra ID external authentication method.