This article describes how to deploy and enforce OS2faktor as a native External Authentication Method (EAM) within Microsoft Entra ID. Using Entra ID's native EAM framework is the recommended standard for production deployments, replacing legacy custom controls and allowing Entra ID to treat OS2faktor as a native MFA provider without federating your primary domain.
1. Establish the OIDC Application in OS2faktor
2. Register OS2faktor as an External Authentication Method in Entra ID
3. Enforce via Conditional Access Policy
4. Production Validation Checklist
ESTABLISH THE OIDC APPLICATION IN OS2FAKTOR
1. Log into your OS2faktor Production Admin Portal (managed via Digital Identity / OS2).
2. Create a new OpenID Connect (OIDC) Integration Profile for Microsoft Entra ID.
3. Record the following output parameters generated by OS2faktor:
- Client ID / App Registration ID
-
Issuer URL (e.g.,
https://<your-org>.os2faktor.dkor the specific OIDC discovery endpoint) - App ID URI / Audience
REGISTER OS2FAKTOR AS AN EXTERNAL AUTHENTICATION METHOD IN ENTRA ID
1. Open the Microsoft Entra admin center (entra.microsoft.com) with Authentication Policy Administrator privileges.
2. Navigate to Protection -> Authentication methods -> Policies.
3. Select Add external authentication method (Preview).
4. Fill out the configuration form:
-
Name:
OS2faktor MFA - Client ID: Enter the Client ID copied from Phase 1.
- Discovery URL / Issuer URL: Enter your production OS2faktor metadata endpoint.
- App ID URI: Enter the target audience string provided by OS2faktor.
5. Under Enable and Target, toggle the status to Enabled and assign it to All Users or a specific production rollout security group (e.g., Grp-Prod-MFA-OS2faktor).
6. Click Save.
ENFORCE VIA CONDITIONAL ACCESS POLICY
1. Navigate to Protection -> Conditional Access -> Policies -> New policy.
2. Set Name: [PROD] Enforce OS2faktor MFA.
3. Under Users, include target operational staff or user groups. Add your Emergency Access / Break-Glass Accounts to the Exclude tab to prevent lockout in case of service disruption.
4. Under Target resources: Select Cloud apps -> All cloud apps (or specific high-risk production applications).
5. Under Access controls -> Grant:
- Select Require multifactor authentication.
- Under Authentication strength, select or create a custom strength that includes your newly created OS2faktor MFA (EAM) provider.
6. Set Enable policy to On and select Create.
PRODUCTION VALIDATION CHECKLIST
- Break-Glass Audit: Verify emergency administrative accounts are excluded from the Conditional Access policy.
- Enrollment Verification: Confirm end-users have bound their active OS2faktor app/token prior to turning the Conditional Access policy fully On.
- Sign-in Diagnostics: Monitor sign-ins under Identity -> Monitoring & health -> Sign-in logs. Ensure the Authentication Details tab reflects success under the External Authentication Method entry.