Mobile Authentication via Microsoft Intune MDM

---

Frontline workers on managed iOS devices authenticate into Entra directly through the 1Kosmos app. When the app launches, it opens the Entra sign-in page. The user selects 1Kosmos as the authentication option, completes a LiveID selfie, and is logged in — no password required.

Prerequisites

In addition to the common prerequisites above:

• Microsoft Intune Admin Center access (Intune Administrator or Application Administrator role in Azure AD)
• 1Kosmos iOS app (.ipa file) available via the shared OneDrive link
• Target user/device group created in Azure AD

Configure Microsoft Entra Application

The Entra app registration provides the credentials that 1Kosmos uses to register and authenticate passkeys on behalf of users.

1. Sign in to the Microsoft Entra portal and navigate to App registrations
2. Create a new application (or use an existing one configured for 1Kosmos)
3. Under API permissions, add the application permission UserAuthenticationMethod.ReadWrite.All and grant admin consent
4. Go to Certificates & secrets and generate a new client secret
5. Note down the Tenant ID, Client ID, and Client Secret - these are required for the workflow secret store

Configure the Workflow Secret Store

The registration workflow requires four secrets configured in the workflow's secret store on the AdminX console. These values are resolved at runtime and are not hardcoded in the workflow.

Secret Name	Type	Value
ecdsaKeyset	JSON	{"privateKey": "...", "publicKey": "..."} - ECDSA P-256 key pair in base64
licenseKey	String	1Kosmos service external license key
wfPrivKey	String	Workflow private key for LiveID wallet decryption - retrieved from the database
entraAppCreds	JSON	{"tenantId": "...", "clientId": "...", "clientSecret": "..."} - from Entra app registration

The authentication workflow requires two secrets:

Secret Name	Type	Value
ecdsaKeyset	JSON	{"privateKey": "...", "publicKey": "..."} - ECDSA P-256 key pair in base64
licenseKey	String	1Kosmos service external license key

Deploy Workflow JSONs

Both the registration and authentication workflow JSONs must be manually injected into the Production database. The Workflow UI import function and Swagger cannot be used for this.

Before deploying, update the data.dvcId field in the workflow JSON root to match your community's LiveID device ID (e.g. {communityName}_liveid_enroll). This is the only manual edit required - all other tenant-specific values are resolved dynamically.

To deploy each workflow:

1. Copy the workflow JSON from the Sandbox database
2. Update data.dvcId to your community's LiveID device ID
3. Inject into the Production database - use PUT for first-time deployment, PATCH to update an existing workflow
4. If required, enable direct access and generate an access code

Deploy the iOS App via Microsoft Intune

The 1Kosmos app is deployed to managed iOS devices as a Line-of-Business (LOB) app in Intune. The app configuration policy pushes the required key-values to the app at runtime.

Add the app:

1. In Microsoft Intune Admin Center, go to Apps → All apps → + Add
2. Select Line-of-business app and click Select
3. Click Select app package file, download the .ipa from the shared OneDrive link, and upload it
4. Fill in the app details — set Minimum OS version to iOS 17.0
5. Under Assignments → Required, add the target user/device group, then click Review + Create → Create

Create the app configuration policy:

1. Go to Apps → App configuration policies → + Add → Managed devices
2. Set Platform to iOS/iPadOS and select the app added above as the targeted app
3. On the Settings tab, select Configuration designer and add the following key-value pairs:

Key	Type	Value
web_launch_url	String	My Sign-Ins
wf_dns	String	sandbox.1kosmos.net
wf_access_code	String	0S0573

These values are deployment-specific and must be updated for each customer environment.

1. Under Assignments, add the same group assigned to the app, then click Review + Create → Create

Install MDM profile on device:

1. On the device, go to Settings → General → VPN & Device Management
2. Confirm the Microsoft Intune MDM profile is present; if prompted, tap Install → Trust
3. Open Company Portal, go to Devices → your device → Sync, and wait for the configuration to apply
4. In Intune Admin Center, verify the config policy shows Succeeded under Device/User status

Registration Flow

Before users can authenticate, they must complete a one-time registration to enroll their LiveID and register a passkey. The flow adapts based on whether the user has previously enrolled their LiveID.

First-time user (no LiveID enrolled):

1. User enters their Entra (Microsoft) username
2. User scans their identity document (e.g., Passport) - face is not captured at this step
3. User captures a selfie to enroll LiveID
4. Passkey is registered on Microsoft Entra and stored in 1Kosmos

Returning user (LiveID already enrolled):

1. User enters their Entra username
2. User captures a selfie to verify against their enrolled LiveID
3. Passkey is registered on Microsoft Entra and stored in 1Kosmos

If a user re-runs registration, the existing passkey entry is updated rather than duplicated. This is expected behavior.

Authentication Flow

Once registered, users authenticate by opening the 1Kosmos app on their Intune-managed device. The app redirects to the Entra sign-in page, the user selects Face / Fingerprint → 1Kosmos, and the authentication workflow launches. The user scans their face, the passkey challenge is signed, and they are logged into Microsoft Entra.