How to configure Microsoft Entra External MFA to trigger identity verification with Persona

About Microsoft Entra External Authentication Methods

Microsoft Entra supports external authentication methods, a way for third-party providers like Persona to act as a genuine multifactor authentication (MFA) factor in Entra ID — not just as a sign-on identity provider.

This lets your Entra administrator require identity verification (such as a selfie check) as part of your organization’s Conditional Access and Authentication Strength policies, gating specific sensitive actions (for example, a password reset or access to a high-risk application) behind a live identity check.

Note: This is different from configuring the Microsoft Entra ID integration, which covers Entra External ID OIDC for single sign-on only. External MFA is a more first-class integration that lets Persona be used as a step-up authentication factor.

Prerequisites

Before you begin, ensure you have:

• Admin access to your Microsoft Entra tenant
• Admin access to your Persona Dashboard, with the Authentications product feature enabled
• acr and amr claims support enabled on your account (contact your Persona account team)

How it works

1. A user attempts to sign in to an application, or perform an action, that’s protected by an Entra Conditional Access policy requiring MFA.
2. Entra redirects the user to Persona as their external authentication method.
3. The user completes a verification inquiry (for example, a selfie check).
4. Upon successful verification, Persona returns an OIDC id_token to Entra confirming the acr/amr claims required for multifactor authentication.
5. Entra grants the user access.

Step 1: Register an app in Microsoft Entra

1. Go to entra.microsoft.com and navigate to App registrations > New registration.
2. Name the registration (for example, “Persona External MFA”).
3. Set Supported account types to single tenant.
4. Add a Web redirect URI: https://authenticate.withpersona.com/authenticate/oidc/authorize
5. Under API permissions, add the openid and profile scopes.
6. Note the Application (client) ID — you’ll need it later as the ID token hint audience.

Step 2: Add Persona as an external authentication method

1. In Entra, go to Authentication Methods > External authentication method > Add external authentication method.
2. Client ID: the client ID from your Persona authentication template (see Step 4).
3. App ID: the Application (client) ID from the app registration you created in Step 1. This app registration acts as a service account for the integration.
4. Discovery endpoint: https://authenticate.withpersona.com/authenticate/oidc/.well-known/openid-configuration

Step 3: Create a Conditional Access policy

1. Go to Conditional Access > Create new policy.
2. Under Access controls > Grant, select Require authentication strength, then choose Multifactor authentication.
3. For more granular control, define a custom authentication strength under Authentication Methods > Authentication Strengths > New authentication strength that limits allowed methods specifically to Persona’s external method (comparable to a custom login-method chain).

Step 4: Configure Persona

Prepare your inquiry template

Create or select an inquiry template with at least a selfie verification step — this fulfills Entra’s face AMR (Authentication Methods Reference) claim.

Add a new account identifier

Entra’s id_token_hint supplies two identifiers, and Persona needs to distinguish between them:

Add a new identifier field (for example, “Entra MFA subject”) to your account type in Account Types in the Persona Dashboard, and enable it as an Identifier.

Configure your authentication template

In your authentication template:

• Allowed redirect URIs: https://login.microsoftonline.com/common/federation/externalauthprovider
• Allowed response types: id_token
• Token endpoint authentication method: Client Secret POST
• Account lookup
  • Hint type: ID token hint
  • ID token hint issuer: https://login.microsoftonline.com/{your-entra-tenant-id}/v2.0 (find your tenant ID on the Entra Overview page)
  • ID token hint audience: the Application (client) ID of the app registration from Step 1
  • ID token hint to account identifier mapping: map sub → your new “Entra MFA subject” identifier, and oid → reference_id
  • ID token subject: your new “Entra MFA subject” identifier

Step 5: Test the integration

1. Sign in to the test user’s account at mysignins.microsoft.com/security-info and select Add sign-in method > External MFA.

   Note: Don’t use your browser’s back button during setup — close the tab and start again from the link above if you need to retry, or Entra will error.

2. Complete the Persona verification to register the factor.

3. Once the sign-in method is registered, sign out and sign back in to an application or action protected by your Conditional Access policy. You should be prompted to complete Persona verification as your MFA step.

⚠️ Important: Only add yourself (or a test user) to a Conditional Access group that requires this MFA method after you’ve successfully registered the sign-in method above. Enabling enforcement first can lock the user out of their account.

Related resources

• Microsoft Entra integration overview
• How to configure Persona Authentications with OpenID Connect
• How to configure Okta (via OIDC) to trigger identity verification with Persona
• Microsoft Learn: External authentication methods

Need help?

Contact your Persona account team to confirm availability of External MFA for your organization, or reach out to Persona support with details about your Entra tenant configuration.