Introduction

With Auth0, you can log in to an Auth0-linked application using not only the user database of Auth0 itself, but also user accounts managed by an external IdP. You can continue to use the user account information registered in your existing IdP, and you can achieve authentication integration with Auth0 with minimal work.
External IdP integration in Auth0 uses the Enterprise Connection feature. On this page, we will target Azure Active Directory (hereinafter referred to as Azure AD) as an external IdP, and introduce the necessary settings and actual login operations.

External IdPs supported by Auth0

You can check the external IdPs supported by Auth0 below. Supports major IdPs such as Okta Workforce Identity and Azure AD.
https://auth0.com/docs/authenticate/identity-providers/enterprise-identity-providers

premise

The settings and operation examples on this page assume that the following has been prepared.

• Auth0-integrated web application
• Create Azure AD tenant

For the login screen function by Auth0, use New Universal Login.
*The Connection Button setting described later is not compatible with the Classic version.

In addition, the information regarding functions and settings described on this page is current as of November 2022.

Setting overview

Setting Example

2. Azure AD settings

*For details on the settings on the Azure AD side, please refer to the following Microsoft page.

https://learn.microsoft.com/en-us/azure/active-directory/develop/quickstart-register-app

• On the Azure portal screen, click [Add] > [App registration]

• After setting each item in the application registration, click [Register].

• Name: Arbitrary setting name
• Supported Account Types: Specifying Scope of Access
• Redirect URL: https://(Auth0 tenant domain name)/login/callback

• Copy the application (client) ID of the registered application (use in 3. Auth0 settings)

• Select [Certificates & secrets] from the left menu and click [New client secret].

• Specify any description and expiration date and click [Add]

• Copy the issued client secret value (use in 3. Auth0 settings)

3. Auth0 settings

• On the Auth0 admin screen, click [Authentication] > [Enterprise]

• Click [Microsoft Azure AD]

• Click [Create Connection]

• After setting each item, click [Create] at the end of the page.

• Connection name: Arbitrary setting name
• Microsoft Azure AD Domain: Azure AD domain to be linked (can be confirmed from Home > Azure Active Directory)
• Client ID: The application (client) ID of your Azure AD application
• Client Secret: The client secret value of your Azure AD application
• Use common endpoint: Disabled
• Identity API: Microsoft Identity Platform (v2)
• Extended Attributes: No selection
• Auth0 APIs: No selection
• Sync user profile attributes at each login: Enabled
• Email Verification: Always set email_verified to 'false'

• Configure the Connection Button settings on the Login Experience tab and click [Save] at the bottom of the page.

• Display connection as a button: Check (display the login button by Azure AD on the login screen)
• Button display name: Specify button display name

• Enable the created Enterprise Connection settings in the linked Application settings

Behavior example when logging in: Login by a user registered in Azure AD

• Perform login operation on the web application screen linked with Auth0 and transition to the login screen provided by Auth0
• Confirm that the [Continue with Azure AD] button is displayed, and click the [Continue with Azure AD] button.

3. After transitioning to the authentication screen on the Azure AD side, enter the user information on Azure AD

4. Click [Accept] when the message asking for permission is displayed.

5. Confirm that you were able to log in to the web application as a user on Azure AD

6. Confirm the user information on the Auth0 management screen

Summary

With Auth0, by using the Enterprise Connection function, you can easily implement authentication processing using an external IdP. You can also try the Enterprise Connection function in the free Auth0 trial environment, so please feel free to experience it.
If you are interested in integrating authentication with Auth0 using your existing IdP, please contact us.

reference

• Enterprise Identity Providers - Auth0 docs
• Connect Your App to Microsoft Azure Active Directory - Auth0 docs
• Quickstart: Register an application with the Microsoft identity platform