PingOne

Setting up PingOne SSO and PingID as the external MFA provider for Microsoft Entra ID

Microsoft Entra ID allows customers to use an external authentication provider for multi-factor authentication (MFA) through external authentication methods (EAMs). In this use case, you’ll learn how to set up Entra ID, PingOne SSO, and PingID to support an EAM in Entra ID.

The high-level process of signing on with an EAM works as follows, with PingOne and PingID acting as the external authentication provider:

  1. A user opens an application protected by Entra ID and is prompted to complete first-factor MFA in Entra ID.

  2. Entra ID determines that another factor needs to be satisfied, such as if a conditional access policy requires MFA.

  3. The user chooses the applicable EAM as second-factor MFA.

  4. Entra ID sends an OIDC authentication request to PingOne (the external authentication provider in this use case).

  5. PingOne initiates MFA for the user.

  6. The user completes the MFA requirement using the PingID app.

  7. PingOne returns an ID token to Entra ID in the authentication response.

  8. Entra ID validates the ID token and signs the users on to the application.

Learn more about EAMs in the Microsoft Entra multifactor authentication external method provider reference in the Entra ID documentation.

Goals

After completing this use case, you’ll know how to:

  • Configure Microsoft Entra ID to support an EAM for MFA.

  • Add Entra ID as an external identity provider (IdP) in PingOne.

  • Set up PingID as the MFA solution for Entra ID users.

What you’ll do

In Microsoft Entra ID, you’ll configure three components:

  1. Add and configure an application.

  2. Create an EAM.

  3. Add a conditional access policy.

In PingOne, you’ll configure the following:

  1. Create a population for Entra ID users.

  2. Create a Microsoft IdP connection.

  3. Add an authentication policy with an external IdP sign-on step.

  4. Add an OIDC application to handle authentication requests from Entra ID.

The last step is configuring PingID as the EAM for Entra ID.

Before you begin

PingOne is a cloud-based identity as a service (IDaaS) framework for secure identity access management that uses an organization-based model to define tenant accounts and their related entities within the PingOne platform. Each organization contains one or more tenants, known as environments, which define separate working domains within an organization.

To set up this use case, you’ll need:

  • A PingOne organization. Learn more in Starting a PingOne trial.

  • A PingOne environment with the PingOne SSO and PingID services added.

    Create a new environment as follows, depending on whether you’re already using PingID:

  • A Microsoft Entra account with an active subscription and an Entra tenant.

Tasks

New PingID accounts: Creating a population for Microsoft Entra ID users

If you created a new PingID environment in PingOne, your new environment includes a population named Default. Learn more in Creating a new PingOne environment with MFA.

If you integrated an existing PingID account with a new PingOne account, skip to Existing PingID accounts: Creating a population for Microsoft Entra ID users and changing the default population.
A screen capture of the Populations page with one Default environment.

When you configure an EAM for Microsoft Entra, you’ll need to create a new population in PingOne for users coming from Entra ID.

Steps

  1. Go to Directory > Populations.

  2. Click the icon to add a new population.

  3. Enter the following:

    1. Population Name: A unique label for the population, such as Entra ID users.

    2. Description (optional): A brief description of the population.

    3. Default Population (optional): Do not click this checkbox in this scenario unless you want to specify this population as the new default population.

  4. Click Save.

    A screen capture of the Populations page with a Default and Entra ID population.

Existing PingID accounts: Creating a population for Microsoft Entra ID users and changing the default population

If you integrated your PingID account with a new PingOne account, your new environment includes a population named Default with users from PingID assigned to this population. The following image shows the Default population with two users from PingID.

If you created a new PingID environment in PingOne, follow the steps in New PingID accounts: Creating a population for Microsoft Entra ID users.
A screen capture of the Populations page with one Default environment that has two identities.

By default, the Identity Provider for this population is set to PingOne. You’ll update this setting as part of this process.

A screen capture of the Populations page with the Default population selected and the details panel showing.

Because you could have a future scenario where users in this environment aren’t coming from Microsoft Entra ID, you should rename the Default population, create a new population for users coming from Entra ID, and set the new population as the default population.

Steps

  1. Go to Directory > Populations.

  2. Click the Default population, and then click the Pencil icon to edit the population.

  3. Change Population Name from Default to a new name, such as Entra ID users.

    A screen capture of the Edit Population panel with the Population Name changed to Entra ID users.

  4. Click Save.

  5. To create a new population, click the icon.

  6. Enter the following:

    1. Population Name: A unique label for the population, such as Home.

    2. Description (optional): A brief description of the population.

    3. Default Population: Click the Enable checkbox to set this population as the new default population.

    4. In the confirmation modal, click Confirm to make this population the new default population.

      A screen capture of the New Population with the Make Default Population confirmation message showing.

  7. Click Save.

Result

You now have two populations in your environment:

  1. Entra ID users: Users from PingID are assigned to this population. This is also the population where future Entra ID users will be assigned when Entra ID redirects users to PingOne for MFA. This population was previously named Default and was previously set as the default population.

  2. Home: This population is the new default population and was created for future scenarios where users are not coming from Entra ID.

A screen capture of the Populations page with two populations: Entra ID users and Home.

Registering your application with Microsoft

To configure an EAM, register an application in Microsoft Entra. Learn more in Quickstart to registering an app in the Microsoft Entra documentation.

Before you begin

Ensure that you have:

  • A Microsoft Entra account with an active subscription

  • An Entra tenant

Steps

  1. Go to the Microsoft Entra admin center.

    If you don’t have a Microsoft Entra account, you can create one now.

  2. On the left, expand Identity > Applications.

  3. Click App registrations.

  4. At the top, click New registration.

  5. In the Name field, enter a user-facing display name for the application.

  6. For Supported account types, select Accounts in this organizational directory only (Ping Identity only - Single tenant) or Accounts in any organizational directory and personal Microsoft accounts, depending on the needs of your organization.

    Select the Single tenant option if you’re working with only identities from your environment.

  7. Under Redirect URI, select Web as the platform and enter the authorization URL of your PingOne environment.

    You can find this URL on the Configuration tab of any OpenID Connect (OIDC) application in the PingOne admin console, in the URLs section.

    The format is <issuer>/authorize.

    Example 1: https://auth.pingone.<region>/<envID>/as/authorize

    Example 2: https://<customDomain>/as/authorize if you set up a custom domain. Learn more in Setting up a custom domain.

  8. Click Register.

Enabling the implicit grant

After registering an application in Entra, enable the implicit grant type for your application to support an EAM.

Steps

  1. Go to the Microsoft Entra admin center.

  2. In the App registrations section, select your application.

  3. Go to Manage > Authentication.

  4. In the Implicit grant and hybrid flows section, select the ID tokens checkbox.

  5. Click Save.

Getting the client ID and client secret for your application and the tenant ID of your Entra tenant

When you register your application with Microsoft, Microsoft generates an application (client) ID and application secret for the application.

Microsoft also generates a directory (tenant) ID for each Microsoft Entra tenant. You’ll copy these values and enter them into PingOne.

Steps

  1. Go to the Microsoft Entra admin center.

  2. In the App registrations section, select your application.

  3. On the left, click Certificates & secrets.

  4. In the Client secrets section, click New client secret.

  5. Enter the following:

    1. Description: A brief characterization of the client secret.

    2. Expires: Select the duration of the certificate, based on the needs of your organization.

  6. Click Add.

  7. In the Client secrets section, locate the value for the applicable secret and copy it to a secure location.

  8. On the left, click Overview.

  9. Locate the Application (client) ID and copy it to a secure location.

  1. Locate the Directory (tenant) ID and copy it to a secure location.

Setting up API permissions

Using an EAM with Microsoft Entra requires certain API permissions that you’ll need to enable in your application.

Steps

  1. Go to the Microsoft Entra admin center.

  2. In the App registrations section, select your application.

  3. On the left, click API permissions.

  4. Click Add a permission.

  5. Click Microsoft Graph.

  6. Click Delegated permissions and expand Openid permissions.

  1. Select the openid and profile permissions.

    User.Read is included by default and should remain selected.

  2. Click Application permissions, expand User, and select the User.Read.All permission.

    If you do not intend to retrieve many attributes from Microsoft Entra ID and populate them into PingOne, you can select the User.ReadBasic.All permission instead of the User.Read.All permission.

    Both of these permissions require admin consent.

  3. To grant admin consent, click Add permissions.

  4. Click Grant admin consent for <your Entra tenant>.

Adding Microsoft as an identity provider in PingOne

Configure the IdP connection in PingOne.

Steps

  1. In PingOne, go to Integrations > External IdPs.

  2. Click Add Provider.

  3. Click Microsoft.

  4. On the Create Profile page, enter the following information:

    • Name: A unique identifier for the IdP.

    • Description: (Optional). A brief description of the IdP.

    You cannot change the icon and login button, in accordance with the provider’s brand standards.

  5. Click Continue.

  6. On the Configure IDP Connection page, enter the following information:

    • Client ID: The application ID from the IdP that you copied earlier. You can find this information on the Microsoft Entra admin center.

    • Client secret: The application secret from the IdP that you copied earlier. You can find this information on the Microsoft Entra admin center.

    • Tenant ID: The tenant ID of your Entra tenant that you copied earlier. You can find this information on the Microsoft Entra admin center.

  7. Click Save and Continue.

  8. On the Map Attributes page, define how the PingOne user attributes are mapped to IdP attributes. Learn more in Mapping attributes.

    • Leave the default PingOne user profile attributes and the external IdP attributes:

      • Preferred Username (from Microsoft) as the source of the PingOne Username

      • Email (from Microsoft) as the source of the PingOne Email Address

    • To add an attribute, click Add attribute.

    • To use the expression builder, click Build and test or Advanced Expression. Learn more in Using the expression builder.

    • Select the update condition, which determines how PingOne updates its user directory with the values from the IdP. The options are:

      • Empty only: Update the PingOne attribute only if the existing attribute is empty.

      • Always: Always update the PingOne directory attribute.

  9. Click Save & Finish.

  10. Click the connection in the Identity Providers list to expand the connection details.

  11. Click the Registration tab, and then click the Pencil icon.

  12. For Population, select the population that you previously created for Entra ID users.

  13. Click Save.

A screen capture of the Microsoft Identity Provider connection with the Entra ID users population selected.

Updating the population

After creating your connection to Microsoft, update the Identity Provider setting for the population that you created for users coming from Entra ID.

The Identity Provider setting is used as the runtime fallback IdP for users in the population who do not have an authoritative IdP configured in their user profile. Updating the population is especially important if you integrated your PingID account with a new PingOne account because those user profiles are created in PingOne without an authoritative IdP set. If the user is removed from the population, the IdP set in the population no longer applies to them.

Steps

  1. Go to Directory > Populations.

  2. Click the population that you previously created for Entra ID users.

  3. Click the Pencil icon.

  4. In the Identity Provider list, select the IdP that you previously created in Adding Microsoft as an identity provider in PingOne.

  5. Click Confirm in the modal, and then click Save.

Adding an authentication policy for external authentication

Add the Microsoft IdP to an authentication policy followed by an MFA step.

Steps

  1. In PingOne, go to Authentication > Authentication.

  2. Click Add policy and enter a name for the policy.

  3. For the first step:

    1. In the Step Type list, select External Identity Provider.

    2. In the External Identity Provider list, select your Microsoft IdP.

    3. For Policy Purpose, select the Entra ID External Authentication Method option.

  4. Click Add step.

  5. For the second step, in the Step Type list, select PingID Authentication.

    A screen capture of an authentication policy with External IDP as the first step and PingID Authentication as the second step.

  6. Click Save.

Configuring the OIDC application

Configure an OIDC application to handle authentication requests from Microsoft Entra ID.

Steps

  1. In PingOne, go to Applications > Applications.

  2. Click to add an application.

  3. Enter the following:

    1. Application name: A unique identifier for the application.

    2. Description (optional): A brief characterization of the application.

    3. Icon (optional): A graphic representation of the application. Use a file up to 1 MB in JPG, JPEG, GIF, or PNG format.

  4. For Application Type, select OIDC Web App.

  5. Click Save.

  6. On the Configuration tab, click the Pencil icon, and enter or edit the following:

    1. For Response Type, clear the default Code checkbox and select ID Token.

    2. For Grant Type, clear the default Authorization Code checkbox and select Implicit.

    3. For Redirect URIs, enter https://login.microsoftonline.com/common/federation/externalauthprovider.

    4. Click Save.

  7. On the Policies tab, click Add policies.

  8. On the PingOne Policies tab, select the authentication policy that you created for users to authenticate with PingOne as the EAM for Microsoft Entra ID.

  9. Click Save.

  10. In the Applications list, click the application’s toggle to enable it.

  11. Click the application entry to open the details panel.

  12. On the Configuration tab, copy the following PingOne application details to add in the Microsoft Entra admin center:

    • Expand the URLs section and copy the OIDC Discovery Endpoint to a secure location.

    • In the General section, copy the Client ID to a secure location.

Creating an external authentication method in Microsoft Entra

After creating the OIDC application in PingOne and copying the application ID, OIDC discovery endpoint, and client ID, create an EAM in Microsoft Entra.

Steps

  1. Go to the Microsoft Entra admin center.

  2. On the left, go to Protection > Authentication methods.

  3. Click App external method.

  4. Enter the following:

    1. Name: Enter a name for the EAM.

    2. Client ID: Enter your PingOne application’s client ID that you copied earlier.

    3. Discovery Endpoint: Enter the OIDC Discovery Endpoint that you copied earlier. The format is <issuer>/.well-known/openid-configuration.

    4. App ID: Enter the ID of the Microsoft Entra application that you copied previously. You can find the application ID in the Microsoft Entra admin center.

  5. Click Request permission.

    The browser opens a new window for you to sign on with your Microsoft Entra admin credentials.

  6. Review the requested permissions and click Accept if you agree.

  7. In the Enable and target section, configure whether you want to include a subset of your users or all users.

  8. Click the Enable toggle to enable the EAM.

Creating a conditional access policy in Microsoft Entra

Configure a conditional access policy in Microsoft Entra to define authentication requirements for users accessing applications.

If your Microsoft Entra tenant contains other conditional access policies that use custom controls to initiate MFA, ensure those policies don’t apply to the same users, groups, and applications that you select in this conditional access policy. Otherwise, your users could be prompted multiple times for MFA.

Steps

  1. Go to the Microsoft Entra admin center.

  2. On the left, go to Protection > Conditional Access.

  3. Click Policies.

  4. Update an existing policy or create a new policy.

  5. Configure the following:

    1. Name: Enter a name.

    2. Users: Select the same users and groups that you selected in your EAM.

    3. Target resources: Select the applications to which you want to apply this conditional access policy.

    4. Grant:

      1. Click Grant access.

      2. Select the Require multifactor authentication checkbox.

      3. Click Select.

    5. Enable policy: Select On to turn on the policy.

  6. Click Save.

Configuring PingID as the external authentication method

Configure a PingID policy to process user MFA requests coming from the PingOne application that you created to handle Microsoft Entra requests.

Steps

  1. In the PingID admin portal, go to Setup > PingID and click the Configuration tab.

    If you selected Enable for Enforce Policy, you might need to create an additional PingID policy. Learn more in the next step.

  2. Click the Policy tab, and on the Web tab, expand and review each policy.

    Microsoft Entra ID doesn’t allow MFA bypasses from an EAM and requires always prompting the user to complete MFA. If you have a policy that can apply to all applications and that has a rule with an action of Approve, you must create a new policy for the PingOne application. Examples of such policies include Recent Authentication or Accessing from Company Network.
    A screen capture of a PingID policy that has a rule with an action of Approve for Recent Authentication.

    1. To add a new policy, click Add Policy.

    2. Enter a name for the policy, such as EAM PingID policy.

    3. In the Target section, in the Applications list, select the PingOne application that you previously created.

    4. For Groups, select all applicable groups.

    5. (Optional) In the Allowed Methods section, select the authentication methods you want to allow.

    6. Click Save.

      A screen capture of a new PingID policy with the PingOne Entra application selected.
      Result:

      The new policy becomes the first PingID policy, which works as a Microsoft Entra ID EAM. PingID will use this new policy when processing MFA requests coming from the PingOne application that you created to handle Microsoft Entra ID requests.

  3. In a scenario where a user forgot or lost their mobile phone and cannot use the PingID app for MFA, you can allow a user to bypass MFA with PingID for a specificed period of time, such as 8 hours.

    1. In PingOne, go to Directory > Users.

    2. Browse or search for the applicable user, and click the user entry to open the details panel.

    3. In the list for the Services tab, select Authentication.

    4. Scroll down to the Integrations section, click the More Options icon, and select Bypass.

    5. In the Bypass window, select the desired amount of time from the Allow bypass of PingID authentication on SSO for list and click Bypass.

      Because Microsoft Entra ID requires the third-party MFA provider to specify the MFA method used and does not accept MFA bypasses as an acceptable MFA method, you must also configure bypass in the Microsoft Entra admin center. Learn more about configuring conditional access in the Microsoft Entra documentation.

Adding an authentication policy for OIDC authentication

If you want to allow users to sign on to the PingOne Self-Service - MyAccount application to manage their MFA methods or to other applications you’ve added to PingOne, you must create an authentication policy for OIDC authentication using the same Microsoft IdP connection.

Steps

  1. In PingOne, go to Authentication > Authentication.

  2. Click Add policy and enter a name for the policy.

  3. For the first step:

    1. In the Step Type list, select External Identity Provider.

    2. In the External Identity Provider list, select your Microsoft IdP. This is the same Microsoft IdP you selected in Adding an authentication policy for external authentication.

    3. For Policy Purpose, select the OIDC Authentication option.

  4. If you want to prompt users for MFA, click Add step, and for the second step, select PingID Authentication in the Step Type list.

    A screen capture of a PingOne authentication policy with External IdP as the first step and PingID Authentication as the second step.

  5. Click Save.

Result:

You now have two authentication policies:

  • An authentication policy for users authenticating with PingOne as the EAM for Microsoft Entra

  • An authentication policy for OIDC authentication to allow users to sign on to other applications

A screen capture of the PingOne Authentication Policies list with two policies: Entra_ID_EAM_Policy and Entra_ID_OIDC_Auth_Policy.

Adding the callback URL to the Microsoft Entra admin center

If you created an authentication policy for OIDC authentication, you must also add the callback URL from the Microsoft IdP connection to the application you registered in the Microsoft Entra admin center.

Steps

  1. In PingOne, go to Integrations > External IdPs.

  2. Locate the Microsoft IdP that you created previously and then click the Details icon to expand the IdP.

  3. Click the Connection tab.

  4. Copy the Callback URL.

    The following examples show the URL format:

    Example 1: https://auth.pingone.<region>/<envID>/rp/callback/microsoft

    Example 2: https://<customDomain>/rp/callback/microsoft

  5. Go to the Microsoft Entra admin center.

  6. In the App registrations section, select your application.

  7. On the left, click Authentication.

  8. Go to Platform configurations > Web > Redirect URIs, and click Add URI.

  9. Paste the Callback URL that you copied from PingOne.

  10. Click Save.

Result

The Redirect URIs section displays both URLs you’ve added:

  1. Authorization URL

  2. Callback URL

A screen capture of the Microsoft Entra Authentication page with two redirect URIs identified with a red number callouts.

Assigning the OIDC authentication policy to an application in PingOne

After you create an authentication policy for OIDC authentication and add the callback URL to the application in Microsoft Entra, assign the OIDC authentication policy to applicable applications in PingOne, such as the PingOne Self-Service - MyAccount application or other applications you’ve added.

Steps

  1. In PingOne, go to Applications > Applications.

  2. Select the relevant application.

  3. On the Policies tab, click Add policies.

  4. On the PingOne Policies tab, select the OIDC authentication policy.

  5. Click Save.

A screen capture of the PingOne Applications page with the PingOne Self-Service - MyAccount app selected and the Policies tab showing an added policy named Entra_ID_OIDC_Auth_Policy.

Next steps

Repeat these steps for any other applications to which you want users to be able to sign on, for example Another App in the following screenshot.

A screen capture of the PingOne Applications page with an example application called Another App selected and the Policies tab showing an added policy named Entra_ID_OIDC_Auth_Policy.

Validation

Now that you’ve set up an EAM in Microsoft Entra ID and configured PingOne and PingID as the external MFA provider, you’re ready to validate that your Entra ID users can use PingID to complete MFA.

  1. Open a new browser window in incognito mode.

  2. In the Microsoft Entra admin center, locate the application you added to the conditional access policy that requires MFA and click the URL for the application.

    In this example, My Apps at https://myapps.microsoft.com.

  3. Sign on to the application and complete the first-factor authentication at Microsoft using a test user’s credentials.

    Result:

    If you, as an Entra ID admin, have activated system-preferred MFA and included the test user as the target user, and if the test user has installed and successfully used the system-preferred MFA method, Entra ID prompts the user to complete MFA action based on what Entra thinks is the most secure method.

    In this example, the test user has installed and used both Microsoft Authenticator and verification code by text message, so Entra ID prompts the user to enter the code from Microsoft Authenticator.

    A screen capture of the Microsoft Enter code page.

    If you haven’t activated system-preferred MFA, the user won’t see the Enter code page and is prompted to verify their identity.

  4. To use your EAM, click Sign in another way at the bottom of the Enter code window.

    Result:

    After selecting Sign in another way or if system-preferred MFA does not apply, Entra ID displays the Verify your identity page.

    A screen capture of the Microsoft Enter code page.

  5. Select the EAM.

    Result:

    Entra ID redirects the browser to PingOne.

  6. If the test user hasn’t yet paired the PingID app, they’re shown a Welcome to PingID page. Click Start to start the pairing process.

    A screen capture of the Welcome to PingID page and then the Add New Device page with a QR code and pairing key.

    Result:

    After pairing, the PingID app prompts the user to complete the MFA requirement.

  7. After PingID is paired for the test user, complete the MFA prompt from the PingID app.

    Result:

    PingOne returns an ID token to Entra ID, and Entra ID processes the ID token and signs the test user on to the application.

  8. Sign out of the application.

  9. In the Microsoft Entra admin center, locate the same application and authenticate to the application again as the test user.

    Result:

    This time, PingID should not prompt the test user to pair a device. Instead, the PingID app should prompt the test user to complete the MFA requirement.

    When the test user completes the MFA requirement, PingOne returns an ID token to Entra ID, and Entra ID processes the ID token and signs the test user on to the application.

    A screen capture of the Microsoft Apps dashboard.