---
title: Authentication flow with Entra ID MFA
slug: access-guide/authentication-flow-with-entra-id-mfa
docTags: 
createdAt: 2026-10-23T14:01:22.404Z
---

The following describes the authentication flow when a user signs in to a Microsoft application configured to use Ivanti Access as an external MFA provider.



![](https://api.archbee.com/api/optimize/V3jJx_afLEcmDauLTrzss/xWfD8_LiEt5cT9WVehTWD_screenshot-2025-12-23-at-111931-am.png)

1. A user attempts to access a Microsoft application. 
2. The user is redirected to Microsoft Entra ID for authentication. 
3. The user authenticates using the configured primary authentication method. 
4. Microsoft Entra ID redirects the user to Ivanti Access using an OpenID Connect (OIDC) request. 
5. Ivanti Access validates the request, evaluates the policy assigned to the Entra ID MFA integration, and prompts the user to authenticate using one of the configured methods: 
   - QR Code 
   - Push Notification 
   - One-Time Passcode (OTP) 
   - Tunnel Authentication 
6. The user completes the MFA challenge. 
7. Ivanti Access redirects the user back to Microsoft Entra ID with an id\_token containing the claims required for verification. 
8. Microsoft Entra ID validates the id\_token signature and claims. 
9. Microsoft Entra ID completes the sign-in process. 
10. The user successfully accesses the application.