> For the complete documentation index, see [llms.txt](https://docs.1kosmos.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.1kosmos.com/authentication/passwordless-for-web-apps/use-cases/entra-passkey-for-frontline-workers/mobile-authentication-via-microsoft-intune-mdm.md).

# Mobile Authentication via Microsoft Intune MDM

***

Frontline workers on managed iOS devices authenticate into Entra directly through the 1Kosmos app. When the app launches, it opens the Entra sign-in page. The user selects 1Kosmos as the authentication option, completes a LiveID selfie, and is logged in — no password required.

#### Prerequisites

In addition to the common prerequisites above:

* Microsoft Intune Admin Center access (Intune Administrator or Application Administrator role in Azure AD)
* 1Kosmos iOS app (`.ipa` file) available via the shared OneDrive link
* Target user/device group created in Azure AD

#### Configure Microsoft Entra Application

The Entra app registration provides the credentials that 1Kosmos uses to register and authenticate passkeys on behalf of users.

1. Sign in to the [Microsoft Entra portal](https://entra.microsoft.com/) and navigate to **App registrations**
2. Create a new application (or use an existing one configured for 1Kosmos)
3. Under **API permissions**, add the application permission `UserAuthenticationMethod.ReadWrite.All` and grant admin consent
4. Go to **Certificates & secrets** and generate a new client secret
5. Note down the **Tenant ID**, **Client ID**, and **Client Secret** - these are required for the workflow secret store

#### Configure the Workflow Secret Store

The registration workflow requires four secrets configured in the workflow's secret store on the AdminX console. These values are resolved at runtime and are not hardcoded in the workflow.

| Secret Name     | Type   | Value                                                                                         |
| --------------- | ------ | --------------------------------------------------------------------------------------------- |
| `ecdsaKeyset`   | JSON   | `{"privateKey": "...", "publicKey": "..."}` - ECDSA P-256 key pair in base64                  |
| `licenseKey`    | String | 1Kosmos service external license key                                                          |
| `wfPrivKey`     | String | Workflow private key for LiveID wallet decryption - retrieved from the database               |
| `entraAppCreds` | JSON   | `{"tenantId": "...", "clientId": "...", "clientSecret": "..."}` - from Entra app registration |

The authentication workflow requires two secrets:

| Secret Name   | Type   | Value                                                                        |
| ------------- | ------ | ---------------------------------------------------------------------------- |
| `ecdsaKeyset` | JSON   | `{"privateKey": "...", "publicKey": "..."}` - ECDSA P-256 key pair in base64 |
| `licenseKey`  | String | 1Kosmos service external license key                                         |

#### Deploy Workflow JSONs

Both the registration and authentication workflow JSONs must be manually injected into the Production database. The Workflow UI import function and Swagger cannot be used for this.

Before deploying, update the `data.dvcId` field in the workflow JSON root to match your community's LiveID device ID (e.g. `{communityName}_liveid_enroll`). This is the only manual edit required - all other tenant-specific values are resolved dynamically.

To deploy each workflow:

1. Copy the workflow JSON from the Sandbox database
2. Update `data.dvcId` to your community's LiveID device ID
3. Inject into the Production database - use `PUT` for first-time deployment, `PATCH` to update an existing workflow
4. If required, enable direct access and generate an access code

#### Deploy the iOS App via Microsoft Intune

The 1Kosmos app is deployed to managed iOS devices as a Line-of-Business (LOB) app in Intune. The app configuration policy pushes the required key-values to the app at runtime.

**Add the app:**

1. In [Microsoft Intune Admin Center](https://intune.microsoft.com/), go to **Apps → All apps → + Add**
2. Select **Line-of-business app** and click **Select**
3. Click **Select app package file**, download the `.ipa` from the shared OneDrive link, and upload it
4. Fill in the app details — set **Minimum OS version** to `iOS 17.0`
5. Under **Assignments → Required**, add the target user/device group, then click **Review + Create → Create**

**Create the app configuration policy:**

1. Go to **Apps → App configuration policies → + Add → Managed devices**
2. Set **Platform** to `iOS/iPadOS` and select the app added above as the targeted app
3. On the **Settings** tab, select **Configuration designer** and add the following key-value pairs:

| Key              | Type   | Value                 |
| ---------------- | ------ | --------------------- |
| `web_launch_url` | String | `My Sign-Ins`         |
| `wf_dns`         | String | `sandbox.1kosmos.net` |
| `wf_access_code` | String | `0S0573`              |

{% hint style="info" %}
These values are deployment-specific and must be updated for each customer environment.
{% endhint %}

4. Under **Assignments**, add the same group assigned to the app, then click **Review + Create → Create**

**Install MDM profile on device:**

1. On the device, go to **Settings → General → VPN & Device Management**
2. Confirm the Microsoft Intune MDM profile is present; if prompted, tap **Install → Trust**
3. Open **Company Portal**, go to **Devices → your device → Sync**, and wait for the configuration to apply
4. In Intune Admin Center, verify the config policy shows **Succeeded** under Device/User status

#### Registration Flow

Before users can authenticate, they must complete a one-time registration to enroll their LiveID and register a passkey. The flow adapts based on whether the user has previously enrolled their LiveID.

**First-time user (no LiveID enrolled):**

1. User enters their Entra (Microsoft) username
2. User scans their identity document (e.g., Passport) - face is not captured at this step
3. User captures a selfie to enroll LiveID
4. Passkey is registered on Microsoft Entra and stored in 1Kosmos

**Returning user (LiveID already enrolled):**

1. User enters their Entra username
2. User captures a selfie to verify against their enrolled LiveID
3. Passkey is registered on Microsoft Entra and stored in 1Kosmos

If a user re-runs registration, the existing passkey entry is updated rather than duplicated. This is expected behavior.

#### Authentication Flow

Once registered, users authenticate by opening the 1Kosmos app on their Intune-managed device. The app redirects to the Entra sign-in page, the user selects **Face / Fingerprint → 1Kosmos**, and the authentication workflow launches. The user scans their face, the passkey challenge is signed, and they are logged into Microsoft Entra.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.1kosmos.com/authentication/passwordless-for-web-apps/use-cases/entra-passkey-for-frontline-workers/mobile-authentication-via-microsoft-intune-mdm.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.