> For the complete documentation index, see [llms.txt](https://docs.1kosmos.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.1kosmos.com/integrations/authentication/external-identity-provider-sso-federation/setting-up-1kosmos-as-an-external-authentication-method-for-microsoft-entra-id.md).

# Setting up 1Kosmos as an External Authentication Method for Microsoft Entra ID

***

> **Roles in this integration**
>
> * **Identity Provider (IdP):** Microsoft Entra ID
> * **1Kosmos role:** External Authentication Method (EAM) / MFA provider
> * **Protocol:** OIDC

### Overview

The integration between 1Kosmos and Microsoft Entra ID (formerly Azure Active Directory) enables users to leverage strong multifactor authentication methods, including passkeys, device biometrics, LiveID, QR code scanning, and more. For organizations already using Entra ID, 1Kosmos enhances security by protecting privileged access, high-risk user logins, and platforms not covered by Microsoft — delivering a consistent authentication experience across cloud, on-premises, and hybrid environments.

### Integration diagram

The integration diagram illustrates how 1Kosmos is configured as a standard OIDC request, showing its role as an external authentication method for Entra ID when accessing applications such as Microsoft 365.

### Create the 1Kosmos External Authentication Method

1. Log in to the [Azure portal](https://portal.azure.com/).
2. Navigate to **Microsoft Entra ID**, then go to **Security > Authentication Methods > Policies**.
3. Click **+ Add External Method**.
4. On the **Add External Method** page, enter the following:
   * **Name** — enter a descriptive, unique name. Users see this name during Entra ID authentication.
   * **Client ID** — copy the Client ID value from the **Client Credentials** section (under OIDC) of the AdminX interface and paste it into the **Client ID** field.
   * **Discovery Endpoint** — copy the Metadata URL from the 1Kosmos AdminX interface (under **Settings > Authorization Server**) and paste it into the **Discovery Endpoint** field.
   * **App ID** — copy the App ID from **App Registrations** under the Entra ID control pane and paste it into the Entra ID **App ID** field.
5. Make sure that admin consent has been granted.
6. To enable the new 1Kosmos EAM method immediately, toggle **Enable** from **Off** to **On**.
7. Before saving, specify the users or group for whom you want to use this new method.
8. Click **Save**. You have now configured 1Kosmos as an external authentication method.

### Configure MFA in 1Kosmos

1. Log in to the AdminX interface as a community administrator.
2. Navigate to **Authentication > Passwordless Login**.
3. Expand the **Passwordless Login using 1Kosmos App** drop-down, and in the **Authentication Factors for Mobile App** section, select the **Primary Authentication Factor** as **Face ID/Touch ID**.
4. Click **Save**.

### Sign in to an application

1. Open the URL of the application you want to sign in to (for example, Office 365).
2. Click **Sign in**.
3. Enter your email ID and click **Next**.
4. Enter your password and click **Sign in**.
5. On the **Verify your identity** page, click **Approve with 1Kosmos\_MFA**. You are redirected to the 1Kosmos\_MFA screen to verify your identity.
6. You are redirected to the 1Kosmos **Sign in** page. Use the 1Kosmos app to scan the QR code, then provide your device-based biometrics to approve the login request. You have now successfully logged in to the application.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.1kosmos.com/integrations/authentication/external-identity-provider-sso-federation/setting-up-1kosmos-as-an-external-authentication-method-for-microsoft-entra-id.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.