Capabilities
Capabilities
Breadcrumbs

External MFA for Microsoft Entra ID

Memority acts as an external Multi-Factor Authentication (MFA) provider for Microsoft Entra ID, through the Microsoft External Authentication Methods (EAM) mechanism.
Your users complete the first factor on Entra ID, then the second factor on Memority: push notification, OTP by mail or SMS, FIDO2/WebAuthn, OATH, and the other authentication methods your tenant offers.

Your users access Microsoft resources with the authentication methods they already enrolled in Memority, and you apply the same authentication levels and Risk-Based Authentication rules to your Microsoft and non-Microsoft applications.

This scenario differs from the federation of an O365 or Azure domain, where Memority handles the whole authentication. Here, Entra ID remains the identity provider and delegates only the multi-factor step to Memority.

How it works

Memority acts as the OpenID Connect (OIDC) provider, and Entra ID acts as the OIDC client.

  1. The user completes the first factor on Entra ID, then selects the external MFA method.

  2. Entra ID redirects the user to the My-Access authorization endpoint and passes the user identity in an id_token_hint.

  3. Memority identifies the user from the information sent in id_token_hint, skips its login page, and proposes only the authentication methods that match the authentication level Entra ID requests.

  4. The user authenticates, and Memority returns a signed id_token with the acr and amr claims.

  5. Entra ID validates the token and signs the user in to the application.

To set up this scenario, see External MFA for Microsoft Entra ID.