Setting up 1Kosmos as an External Authentication Method for Microsoft Entra ID

The steps to configure 1Kosmos as an External Authentication Method (EAM) for Microsoft Entra ID using OIDC.

---

Roles in this integration

• Identity Provider (IdP): Microsoft Entra ID
• 1Kosmos role: External Authentication Method (EAM) / MFA provider
• Protocol: OIDC

Overview

The integration between 1Kosmos and Microsoft Entra ID (formerly Azure Active Directory) enables users to leverage strong multifactor authentication methods, including passkeys, device biometrics, LiveID, QR code scanning, and more. For organizations already using Entra ID, 1Kosmos enhances security by protecting privileged access, high-risk user logins, and platforms not covered by Microsoft — delivering a consistent authentication experience across cloud, on-premises, and hybrid environments.

Integration diagram

The integration diagram illustrates how 1Kosmos is configured as a standard OIDC request, showing its role as an external authentication method for Entra ID when accessing applications such as Microsoft 365.

Create the 1Kosmos External Authentication Method

1. Log in to the Azure portal.
2. Navigate to Microsoft Entra ID, then go to Security > Authentication Methods > Policies.
3. Click + Add External Method.
4. On the Add External Method page, enter the following:

   • Name — enter a descriptive, unique name. Users see this name during Entra ID authentication.
   • Client ID — copy the Client ID value from the Client Credentials section (under OIDC) of the AdminX interface and paste it into the Client ID field.
   • Discovery Endpoint — copy the Metadata URL from the 1Kosmos AdminX interface (under Settings > Authorization Server) and paste it into the Discovery Endpoint field.
   • App ID — copy the App ID from App Registrations under the Entra ID control pane and paste it into the Entra ID App ID field.
5. Make sure that admin consent has been granted.
6. To enable the new 1Kosmos EAM method immediately, toggle Enable from Off to On.
7. Before saving, specify the users or group for whom you want to use this new method.
8. Click Save. You have now configured 1Kosmos as an external authentication method.

Configure MFA in 1Kosmos

1. Log in to the AdminX interface as a community administrator.
2. Navigate to Authentication > Passwordless Login.
3. Expand the Passwordless Login using 1Kosmos App drop-down, and in the Authentication Factors for Mobile App section, select the Primary Authentication Factor as Face ID/Touch ID.
4. Click Save.

Sign in to an application

1. Open the URL of the application you want to sign in to (for example, Office 365).
2. Click Sign in.
3. Enter your email ID and click Next.
4. Enter your password and click Sign in.
5. On the Verify your identity page, click Approve with 1Kosmos_MFA. You are redirected to the 1Kosmos_MFA screen to verify your identity.
6. You are redirected to the 1Kosmos Sign in page. Use the 1Kosmos app to scan the QR code, then provide your device-based biometrics to approve the login request. You have now successfully logged in to the application.