Overview
Microsoft Entra ID is an identity management platform. It helps organizations manage secure access to applications and resources. When you integrate Microsoft Entra ID with Persona, you can use Persona identity verification in the Microsoft ecosystem. Use it to manage employee authentication and account recovery workflows, including password resets and MFA method revocation.
Prerequisites
To set up the Microsoft Entra ID integration with Persona, you need:
- A Microsoft Entra tenant that is configured for service.
- A completed onboarding process with Persona. To create an account, register through the Persona Dashboard.
Connect Microsoft Entra ID to your Persona account
Go to the Marketplace integrations in your Persona dashboard and select Microsoft Entra ID.
Microsoft Entra ID supports two authentication methods:
- Delegated permissions (default) — lets you manage all user authentication methods.
- Application permissions (app-only) — lets you do a limited set of authentication method operations.
For more information about the differences between these permission types, read the Microsoft documentation on delegated and application permissions.
Option 1: Delegated permissions
With delegated permissions, Persona acts for a signed-in user and accesses a range of Microsoft Graph authentication methods APIs. The permissions of the authorizing user control which Microsoft Entra ID operations Persona can do for the user.
Supported operations and associated permissions:
- Get user -
User.Read.All,CustomSecAttributeAssignment.Read.All - Get user by email -
User.Read.All - Create a user -
User.ReadWrite.All - Update a user -
User.ReadWrite.All,User-PasswordProfile.ReadWrite.All - List authentication methods -
UserAuthenticationMethod.ReadWrite.All - Delete authentication method -
UserAuthenticationMethod.ReadWrite.All - Reset password -
UserAuthenticationMethod.ReadWrite.All - Create temporary access pass -
UserAuthenticationMethod.ReadWrite.All
Setup steps:
- Select + Add credential. Select Microsoft Entra Authorization.
- Give this credential a name (for example, “Persona”).
- Sign in to your Microsoft account.
Note: Persona needs the offline_access permission to keep access to Graph APIs.
Option 2: Application permissions (app-only)
With application permissions, Persona authenticates with its own identity (client credentials), not for a user. This is useful for automated scenarios that run with no person present. The permissions of the app control which Microsoft Entra ID operations Persona can do.
Supported operations and associated permissions:
- Get user -
User.ReadWrite.All - Get user by email -
User.ReadWrite.All - Create a user -
User.ReadWrite.All - Update a user -
User.ReadWrite.All,User-PasswordProfile.ReadWrite.All - List authentication methods -
UserAuthenticationMethod.ReadWrite.All - Delete authentication method -
UserAuthenticationMethod.ReadWrite.All - Create temporary access pass -
UserAuthenticationMethod.ReadWrite.All
Unsupported operations:
- Reset password — Microsoft does not support this operation with application-only permissions
If your use case requires password resets, you can use the Update a user request to update the password profile of a user.
Setting up app-only permissions
- In the Azure/Entra portal, go to App registrations (not Enterprise Applications).
- Select your Persona application or create a new app registration.
- Under Certificates & secrets, create a new client secret. Keep it in a secure location.
- Under API permissions, add the applicable Application permissions (not Delegated).
- Click Grant admin consent for your tenant.
- In your Persona dashboard, go to Marketplace Integrations. Search for Microsoft Entra.
- Select + Add credential.
- Give this credential a name (for example, “Persona App-Only”).
- Enter your:
- Tenant ID
- Client ID (Application ID)
- Client Secret
Your employee’s experience
To help an employee reset their password, put their Entra ID in the inquiry URL before you send it. The Entra ID is usually their work email address. Your helpdesk can generate a Persona inquiry link that includes the Entra ID of the employee in the URL.
Persona uses this ID to get employee data from Microsoft Entra, for example name and date of birth. Persona can then verify that it is the correct person before it makes account updates.
After verification, Persona shows the employee a temporary password. The employee uses it to sign in at https://entra.microsoft.com. Entra then tells them to set a new password.
For more information about what the employee sees, read What to expect when verifying your identity with Persona to reset your Microsoft Entra ID password.
Resetting an employee’s MFA
The integration can also reset the multi-factor authentication (MFA) of an employee. To do this, it deletes a registered authentication method. This revokes that factor. The employee must then enroll it again at the next sign-in. Microsoft Graph does not have one “reset all factors” endpoint, as Okta does. Thus, MFA reset in Entra works one method at a time, with two operations in sequence:
- List authentication methods — gets the registered methods of the employee, so you can find the method to reset. The response includes the
@odata.type(which maps to the method type) and theidof each method. - Delete authentication method — deletes the specific method with its type and ID. This revokes that factor. At the next sign-in, Entra tells the employee to enroll it again, as your Entra policies specify.
The Method Type parameter selects the type of method to delete. It accepts one of these values:
softwareOathMethodsemailMethodsfido2MethodsmicrosoftAuthenticatorMethodsphoneMethodsplatformCredentialMethodstemporaryAccessPassMethodswindowsHelloForBusinessMethods
Both operations require the UserAuthenticationMethod.ReadWrite.All permission. You can delete an authentication method only with delegated permissions. As with password reset, Microsoft Graph does not support it with application-only permissions.
You cannot undo the deletion of an authentication method. The deletion revokes that factor immediately. Before you continue, make sure that you delete the correct method for the correct user. Before you revoke a factor, we recommend that you verify the identity of the employee with a Persona inquiry.
Frequently Asked Questions
What minimum permissions and scopes are required?
You must create a Microsoft Entra API credential with the applicable scopes. These include User.Read.All and UserAuthenticationMethod.ReadWrite.All. If you do not give these permissions, the integration setup fails with the message “Need admin approval: Persona needs permission to access resources in your organization that only an admin can grant.”
For delegated permissions: The signed-in user must have these delegated permissions and the applicable admin privileges.
For app-only permissions: Grant these application permissions to the application in the App registration. Also grant admin consent.
Can I reset all of an employee’s MFA factors at once?
No. Microsoft Graph does not have one endpoint that resets all factors at the same time. Thus, the integration resets MFA one method at a time. First, list the authentication methods of the employee. Then delete each method that you want to revoke. For each deleted method, the employee must enroll again at the next sign-in. As with password reset, this works only with delegated permissions.
How can I get my user a verification link?
In many cases, employees may contact a helpdesk through ServiceNow or similar tools. The helpdesk can put the Entra ID of the employee in the inquiry URL before it sends the URL. Persona then gets data from Entra to verify the identity. After that, Persona does the configured authentication method operation. If you use password reset, Microsoft Entra makes the employee change their password at the next sign-in.
Plans Explained
Microsoft Entra Integration by plan
| Startup Program | Essential Plan | Growth Plan | Enterprise Plan | |
|---|---|---|---|---|
| Microsoft Entra Integration | Not Available | Not Available | Limited | Available |