How to Configure Advanced User Sync in Microsoft Entra ID Admin Console

​

Introduction

This document explains how to register and configure an application in Microsoft Entra ID and enable FIDO2 (Passkey) authentication for integration with the Tenant Admin Portal.

​

Prerequisite

You must have Tenant Admin Access for Microsoft Entra ID.

​

Steps to Configure Microsoft Entra ID for Advanced User Sync

1. Register an Application
2. Configure the Application
3. Create Client Secret
4. Enable FIDO2 Authentication

Microsoft Entra ID is configured Successfully.

​

Register an Application

1. Log in to Azure Portal and select Microsoft Entra ID on the home page. The Microsoft Entra ID page is displayed.
2. Go to Overview > Manage > App registrations > New registration. The Register an application page is displayed.
3. Do the following.
   1. Enter Name.
   2. Select Supported account types.
      Note: Select Accounts in this organizational directory only.
   3. Click Register. The application is registered successfully.

​

Configure the Application

1. Navigate to the newly registered app > API Permissions > Add a permission > Microsoft Graph. The Request API Permissions pop-up box is displayed.
2. Select Application permissions. The List of API permissions is displayed.
3. Do the following:
   1. On User drop-down, select the following:
      1. User.Read.All
      2. User.Read Basic.All (Optional).
   2. On GroupMember drop-down, select the GroupMember.Read.All
   3. On UserAuthenticationMethod drop-down, select the UsersAuthenticationMethod.ReadWrite.All
   4. On Policy drop-down, select the following:
      1. Policy.Read.AuthenticationMethod.
      2. Policy.ReadWrite.AuthenticationFlows.
   5. Click Add Permissions. The Permissions are listed on the API.
   6. Click Grant admin consent for Oloid inc. The API Permissions are successfully created.

​

Create Client Secret

1. Go to Certificates & secrets > Client Secrets > + New client secret. The Add a client secret screen is displayed.
2. Do the following:
   1. Enter Description.
   2. Select the Expires duration from the drop-down list.
      Note: Select 365 days (12 months).
   3. Click Add. The Client Secret is added successfully and listed on Client Secret tab.
      Note: Click on the Copy to Clipboard icon next to the value field to copy the secret. This option is available only at the time of creation.
      
3. Go to Overview and copy the values of Client ID and Directory (Tenant) ID. The application is configured successfully.

​

Enable FIDO2 Authentication in Azure Portal

1. Go to Tenant Overview > Manage > Security in the vertical navigation menu.
2. Go to Security > Manage > Authentication Methods. The Authentication page is displayed.
3. Go to Manage > Policies, select Passkey (FIDO2) in Authentication method policies table. The Passkey (FIDO2) setting page is displayed.
4. Click Enable and Target tab and do the following:
   1. Enable the toggle.
   2. Select All User as Target.
      Note: If you want all users to use FIDO2 authentication.
   3. Click Save. The Enable and Target tab is configured successfully.
5. Click Configure tab and do the following:
   1. Select Allow Self-Service set up Yes.
   2. Select Enforce Attestation No.
   3. Select Enforce key restrictions No.
   4. Select Restrict specific key Allow.
   5. Click Save. The Configure tab is configured successfully. FIDO2 is successfully configured.

Related Documents

How to Configure Advanced User Sync for Entra ID - Inbound in the Tenant Admin Portal