# Configure Persona as an Authentication Method in Microsoft Entra

> How to configure Microsoft Entra External Authentication Methods (External MFA) so Persona can act as a multifactor authentication factor

Source: https://help.withpersona.com/articles/nqgRyHgsOa8eKTLJDuH3ON/
Section: Marketplace and 3rd-Party Integrations > Authentication > Microsoft Entra

## About Microsoft Entra External Authentication Methods

Microsoft Entra supports [external authentication methods](https://learn.microsoft.com/en-us/entra/identity/authentication/concept-authentication-external-method-provider), a way for third-party providers like Persona to act as a genuine multifactor authentication (MFA) factor in Entra ID — not just as a sign-on identity provider.

This lets your Entra administrator require identity verification (such as a selfie check) as part of your organization's Conditional Access and Authentication Strength policies, gating specific sensitive actions (for example, a password reset or access to a high-risk application) behind a live identity check.

ℹ️

This is different from [configuring the Microsoft Entra ID integration](https://help.withpersona.com/articles/6vHVa8KcEURyza3nk2v0RH/), which covers Entra External ID OIDC for single sign-on only. External MFA is a more first-class integration that lets Persona be used as a step-up authentication factor.

## Prerequisites

Before you begin, ensure you have:

- Admin access to your Microsoft Entra tenant
- Admin access to your Persona Dashboard, with the [Authentications product feature](https://help.withpersona.com/articles/1Acdx2QDfwgE1q3DTVPqW4/) enabled
- `acr` and `amr` claims support enabled on your account (contact your Persona account team)

## How it works

1.  A user attempts to sign in to an application, or perform an action, that's protected by an Entra Conditional Access policy requiring MFA.
2.  Entra redirects the user to Persona as their external authentication method.
3.  The user completes a verification inquiry (for example, a selfie check).
4.  Upon successful verification, Persona returns an OIDC `id_token` to Entra confirming the `acr`/`amr` claims required for multifactor authentication.
5.  Entra grants the user access.

## Step 1: Register an app in Microsoft Entra

1.  Go to [entra.microsoft.com](https://entra.microsoft.com/) and navigate to **App registrations > New registration**.
2.  Name the registration (for example, "Persona External MFA").
3.  Set **Supported account types** to single tenant.
4.  Add a **Web** redirect URI: [`https://authenticate.withpersona.com/authenticate/oidc/authorize`](https://authenticate.withpersona.com/authenticate/oidc/authorize)
5.  Under **API permissions**, add the `openid` and `profile` scopes.
6.  Note the **Application (client) ID** — you'll need it later as the ID token hint audience.

## Step 2: Add Persona as an external authentication method

1.  In Entra, go to **Authentication Methods > External authentication method > Add external authentication method**.
2.  **Client ID**: the client ID from your Persona authentication template (see Step 4).
3.  **App ID**: the Application (client) ID from the app registration you created in Step 1. This app registration acts as a service account for the integration.
4.  **Discovery endpoint**: `https://authenticate.withpersona.com/authenticate/oidc/.well-known/openid-configuration`

## Step 3: Create a Conditional Access policy

1.  Go to **Conditional Access > Create new policy**.
2.  Under **Access controls > Grant**, select **Require authentication strength**, then choose **Multifactor authentication**.
3.  For more granular control, define a custom authentication strength under **Authentication Methods > Authentication Strengths > New authentication strength** that limits allowed methods specifically to Persona's external method (comparable to a custom login-method chain).

## Step 4: Configure Persona

### Prepare your inquiry template

Create or select an [inquiry template](https://app.withpersona.com/dashboard/inquiry-templates) with at least a **selfie verification** step — this fulfills Entra's `face` AMR (Authentication Methods Reference) claim.

### Add a new account identifier

Entra's `id_token_hint` supplies two identifiers, and Persona needs to distinguish between them:

| Claim | Description                                                                                         | Maps to                 |
| ----- | --------------------------------------------------------------------------------------------------- | ----------------------- |
| `oid` | The user's identifier within the Entra tenant. Used for Entra APIs and the Marketplace integration. | `reference_id`          |
| `sub` | Specific to the app registration created in Step 1. Only valid for this MFA integration.            | A new custom identifier |

Add a new identifier field (for example, "Entra MFA subject") to your account type in **Account Types** in the Persona Dashboard, and enable it as an **Identifier**.

### Configure your authentication template

In your [authentication template](https://app.withpersona.com/dashboard/authentication-templates):

- **Allowed redirect URIs**: [`https://login.microsoftonline.com/common/federation/externalauthprovider`](https://login.microsoftonline.com/common/federation/externalauthprovider)
- **Allowed response types**: `id_token`
- **Token endpoint authentication method**: Client Secret POST
- **Account lookup**
  - **Hint type**: ID token hint
  - **ID token hint issuer**: `https://login.microsoftonline.com/{your-entra-tenant-id}/v2.0` (find your tenant ID on the Entra **Overview** page)
  - **ID token hint audience**: the Application (client) ID of the app registration from Step 1
  - **ID token hint to account identifier mapping**: map `sub` → your new "Entra MFA subject" identifier, and `oid` → `reference_id`
  - **ID token subject**: your new "Entra MFA subject" identifier

## Step 5: Test the integration

1.  Sign in to the test user's account at [mysignins.microsoft.com/security-info](https://mysignins.microsoft.com/security-info) and select **Add sign-in method > External MFA**.

    > **Note:** Don't use your browser's back button during setup — close the tab and start again from the link above if you need to retry, or Entra will error.

2.  Complete the Persona verification to register the factor.
3.  Once the sign-in method is registered, sign out and sign back in to an application or action protected by your Conditional Access policy. You should be prompted to complete Persona verification as your MFA step.

⚠️

Only add yourself (or a test user) to a Conditional Access group that requires this MFA method **after** you've successfully registered the sign-in method above. Enabling enforcement first can lock the user out of their account.

## Related resources

- [Microsoft Entra integration overview](https://help.withpersona.com/articles/76oPGnRkduS3sHbEpLNSku/)
- [How to configure Persona Authentications with OpenID Connect](https://help.withpersona.com/articles/1Acdx2QDfwgE1q3DTVPqW4/)
- [Configure Persona as an Authentication Method in Okta](https://help.withpersona.com/articles/3ZFkLLXBFVACuqlwQbUcFG/)
- [Microsoft Learn: External authentication methods](https://learn.microsoft.com/en-us/entra/identity/authentication/concept-authentication-external-method-provider)

## Need help?

Reach out to Persona support with details about your Entra tenant configuration.

## Plans Explained

### Microsoft Entra Integration by plan

|                             | Startup Program | Essential Plan | Growth Plan | Enterprise Plan |
| --------------------------- | --------------- | -------------- | ----------- | --------------- |
| Microsoft Entra Integration | Not Available   | Not Available  | Limited     | Available       |

[Learn more about pricing and plans](https://withpersona.com/pricing?utm_source=product&utm_medium=referral&utm_audience=a&utm_campaign=cm_gen_ds_hc-plan-table).