Configure Microsoft Entra ID as a Custom OIDC Identity Provider in Okta

The built-in Okta Microsoft Identity Provider (IdP) uses the /common endpoint, which allows authentication from any Microsoft Entra ID tenant and personal Microsoft accounts. When administrators use the built-in Microsoft IdP, unauthorized users with personal Microsoft accounts or external Entra ID accounts successfully authenticate into the Okta environment. To restrict authentication to a specific Entra ID tenant, administrators must register an application in Microsoft Entra ID and configure a Custom OpenID Connect (OIDC) IdP in Okta.

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Microsoft Identity Provider
• Custom OpenID Connect (OIDC) Identity Provider
• Microsoft Entra ID

The built-in Microsoft IdP in Okta sets the authorization endpoint to https://login.microsoftonline.com/common. The /common endpoint inherently accepts credentials from any Microsoft Entra ID tenant and personal Microsoft accounts, which prevents administrators from restricting access to a single tenant.

How is the application registered in Microsoft Entra ID?

Register a new application in the Microsoft Entra ID portal to generate the necessary credentials and restrict access to a single tenant.

1. Sign in to the Microsoft Azure portal.
2. Navigate to Microsoft Entra ID, and then select App registrations.
3. Select New registration.
4. Enter a name for the application.
5. Choose Accounts in this organizational directory only (Single tenant) under the Supported account types section.
6. Select Web from the Redirect URI dropdown menu, and then enter the Okta callback URL (e.g., https://<okta-domain>.okta.com/oauth2/v1/authorize/callback).
7. Select Register.

Generate the client secret and gather the endpoint URLs.

Obtain the Application ID, generate a Client Secret, and locate the OpenID Connect endpoints required for the Okta configuration.

1. Navigate to the Overview page of the newly registered application.
2. Copy and save the Application (client) ID and the Directory (tenant) ID.
3. Select Endpoints from the top menu.
4. Copy and save the OpenID Connect metadata document URL, the OAuth 2.0 authorization endpoint (v2.0), and the OAuth 2.0 token endpoint (v2.0).
5. Navigate to Certificates & secrets in the left menu.
6. Select New client secret.
7. Enter a description, choose an expiration period, and then select Add.
8. Copy and save the Value of the client secret immediately. NOTE: Microsoft Entra ID hides the client secret value after the user navigates away from the page.

How is the Custom OIDC Identity Provider configured in Okta?

Create a Custom OIDC IdP in the Okta Admin Console using the gathered Microsoft Entra ID credentials and endpoints.

1. Navigate to Security, and then select Identity Providers in the Okta Admin Console.
2. Select Add Identity Provider, and then choose Add OpenID Connect IdP.
3. Enter a name for the Identity Provider.
4. Enter the Application (client) ID into the Client ID field.
5. Enter the saved client secret into the Client Secret field.
6. Enter the OAuth 2.0 authorization endpoint (v2.0) into the Authorization endpoint field.
7. Enter the OAuth 2.0 token endpoint (v2.0) into the Token endpoint field.
8. Enter https://login.microsoftonline.com/<tenant-id>/v2.0 into the Issuer URI field, replacing <tenant-id> with the saved Directory (tenant) ID.
9. Enter https://login.microsoftonline.com/<tenant-id>/discovery/v2.0/keys into the JWKS endpoint field, replacing <tenant-id> with the saved Directory (tenant) ID.
10. Select Finish to save the configuration.