Configure Passport with Microsoft Entra ID - Web Login

Learn how to create an OpenID Connect (OIDC) application in Microsoft Entra ID for Kandji Passport that can support MFA

This article goes over configuring Passport to use Web login. If you want to configure Mac Login, please see Configure Passport with Microsoft Entra ID - Mac Login.

• Prerequisites
• Create the App Registration
• Assign Users and Groups
• User Account Provisioning via Passport
• Other Considerations
• Microsoft Entra ID Troubleshooting
• Next Steps

Prerequisites

You will need access to a Microsoft Entra ID admin user account to grant the Passport app the correct permissions. For instructions on configuring multifactor authentication (MFA) within Microsoft Entra ID, please see this Microsoft guide.

Create the App Registration

1. Sign in to the Microsoft Entra admin center using a Global Administrator account.
2. Open the portal menu and then select Identity.
3. On the Identity menu, under Applications, select App registrations.
4. On the App registrations select + New registration on the menu.
   
5. On the Register an application dialog, enter a name for the new application (such as Kandji Passport Web Login).
6. Choose Accounts in this organizational directory only.
7. In the Redirect URI section, in the Select a platform drop-down, choose Public client/native (mobile & desktop).
8. In the URI field, enter the following, https://login.microsoftonline.com/common/oauth2/nativeclient
9. Click Register.
   
10. Open a secure text document where the values for this OIDC app can be temporarily stored. You will need these details when you configure the Passport Library Item.
11. Copy the Application (client) ID on the Overview page to a temporary secure text document.
12. While still on the Overview page, click Endpoints.
    
    
13. Copy OpenID Connect metadata document (identity provider URL) to a temporary secure text document.
    
    
14. On the left, select Authentication.
15. Set Enable the following mobile and desktop flows to Yes.
16. Click Save.
    
17. On the left, select Token configuration.
18. Click Add optional claim.
19. For the Token type, select ID.
20. For the Claim, select preferred_username.
21. Click Add.
    
22. While still on the Token configuration page, click Add groups claim.
23. Select All Groups...
24. Click Add.
    Once you complete the token configurations, you will see both optional claims.
    
25. Select API Permissions.
26. Click Add a permission.
27. Click Microsoft Graph.
    
28. Select Delegated permissions.
29. Confirm that the OpenID permissions section is expanded. If it isn't, click the icon next to it to expand it.
30. Select email.
31. Select profile.
    
32. In the Select permissions field, enter User.Read.
33. In the User section, confirm that User.Read is already selected. If it isn't, select it.
34. Click Add permissions.
    
35. While still on the API permissions page, select Grant admin consent for <your_tenant_name>.
36. Select Yes.
    You should see a notification similar to the one below and a "Granted for <your_tenant_name> ..." message in the Status column next to each permission.
37. Continue to the next section.

Assign Users and Groups

By default, when you create a new App registration, the "Assignment required?" attribute is set to "No". However, if your Passport Enterprise app is set to require assignment, you will need to follow these steps to assign users in order to be able to use your Passport app.

1. In the Identity navigation menu on the left, open Applications and select Enterprise Applications.
2. In the All applications list, select Kandji Passport Web Login or whatever name you named the App registration in the previous section.
   
3. Under Manage, select Properties.
4. Optionally, add a logo to your Enterprise App.
5. Inspect the Assignment required? setting. If it is set to "No," then you can skip the rest of this section. All users in Entra ID will be able to use the Passport app.
6. Confirm that the Visible to users? setting is set toggled to "No"; otherwise, users will see it in their portal. The Passport app is only useful as a replacement for the macOS login window.
7. Click Save.
   
8. If the Assignment required? setting is set to "Yes," 
9. Under Manage, select Users and Groups.
   
10. On the menu, select + Add user/group.
    
11. On the Add Assignment dialog, select the link under Users and groups.
12. A list of users and security groups is displayed. You can search for a specific user or group or select multiple users and groups that appear in the list.
13. After you have selected your users and groups, select Select.
    If you see the message below, it means that a free tier is being used. You can only add users (not groups) to the Passport Enterprise App.
    
14. Select Assign to finish the assignment of users and groups to the app.
    
15. Confirm that the users and groups you added appear in the Users and groups list.
    
16. With this portion of the Entra ID configuration complete, review the remaining sections of this article for your Microsoft Entra ID environment

17. User Account Provisioning via Passport

    If you use Specify per identity provider group option in the Passport Library Item, use the Entra ID group ObjectID in the Identity provider group field.

    1. Sign in to the Microsoft Entra admin center. In the Identity navigation menu on the left, open Groups and select All groups.
    2. Select the group that you want to use.
       
    3. Copy the Object Id for that group.
       
    4. In the Kandji Passport Library Item, in the User Provisioning section, paste the value from the previous section into the Identity provider group field.
       
    5. Repeat the previous steps for each additional Entra ID group you want to use.
    6. In the Passport Library Item, click Save.

Other Considerations

• If you are setting the default account type to standard user, only add administrator account types in the Identity provider groups. Unless otherwise specified as administrators in your Identity provider groups, all users will be created as standard users by default.
• If you are setting the default account type to administrators, only add standard account types in the Identity provider groups. All users will be created as administrators by default unless otherwise specified as standard users in your Identity provider groups.

Microsoft Entra ID Troubleshooting

If you are experiencing issues with Entra ID Passport, please visit our Passport Troubleshooting with Microsoft Entra ID (formerly Azure AD) support article to learn more about common troubleshooting steps.

Next Steps

Please proceed to the Configure the Passport Library Item support article to finalize your setup.