Entra EAM (Beta)

Enable passwordless, biometric login for Microsoft Entra External Authentication Method (EAM) users using 1Kosmos as an OIDC Identity Provider.

---

Prerequisites

Before starting, make sure you have:

• AdminX portal — Admin access to your 1Kosmos AdminX tenant.
• Microsoft Entra ID — Admin access to configure an External Authentication Method.
• 1Kosmos mobile app — Installed and enrolled on iOS or Android. (Android · iOS)

  • Biometrics (Touch ID / Face ID or LiveID) must be enrolled before testing.

---

Step 1 — Create the OIDC Application in AdminX

1. Sign in to the AdminX portal and go to Applications → Add Application.
2. Under Pre-built integrations, click Add Integration on the Entra EAM card.
3. Fill in the following fields:

   Field	Value
   Application Name	A unique name to identify this application (e.g., default_EAM)
   Application Logo	Upload a .png, .jpg, or .gif file, max 2MB
   Grant Type	Implicit
   Signing Algorithm for ID Token	RS256
   Sign-in Redirect URIs	https://login.microsoftonline.com/common/federation/externalauthprovider

4. Under Scopes, select what's required for your use case:

   Scope	Description
   openid	Required for OIDC authentication
   profile	User profile information
   email	User email address
   identity_assurance	Identity proofing assurance level
   /assurance/ial/2/	IAL2-level identity assurance
   extension:activate	Extension activation scope

5. Under Login Screen Customizations, configure display options as needed:

   Option	Description
   Hide Banner	Hides the 1Kosmos banner on the login screen
   Hide Mobile App Download Links	Removes app store links from the login screen
   Change App Name	Displays a custom app name on the login screen

6. Toggle Force Re-authentication on if users should re-authenticate on every visit.
7. Click Next to save the application.

---

Step 2 — Test the Connection

1. Open a browser and sign in to your Microsoft Entra-protected application.
2. When prompted for additional authentication, select the 1Kosmos option.
3. You'll be redirected to the 1Kosmos login screen with a QR code.
4. On the 1Kosmos mobile app home screen, tap Scan QR.
5. Scan the QR code. When prompted, select Allow only while using the app.
6. Tap Authenticate and complete biometric verification (Touch ID, Face ID, or LiveID).
7. On success, you'll be signed in to your application.