Configuring Entra ID MFA
Entra ID MFA requires configuration in both Ivanti Access and Microsoft Entra ID. Complete the following topics in the order listed:
- Copying the Authorization Endpoint URL
- Registering an application in Microsoft Entra ID
- Adding the Entra ID MFA integration
- Configuring Entra ID MFA policies
- Configuring External MFA in Microsoft Entra ID
- Registering users for Ivanti Access MFA
- Creating a Conditional Access policy in Microsoft Entra ID
- Restricting enrollment in alternative sign-in methods
- Validating the configuration
Copying the Authorization Endpoint URL
Copy the Authorization Endpoint URL from Ivanti Access. You need this URL to register an application in Microsoft Entra ID.
Procedure
- In the Ivanti Access administrative portal, go to Profile > Entra ID MFA.
- Copy the Authorization Endpoint URL displayed on the page.
Next steps
Register an application in Microsoft Entra ID.
Registering an application in Microsoft Entra ID
Register an application in Microsoft Entra ID to generate the Application (client) ID and Directory (tenant) ID required for the Entra ID MFA integration in Ivanti Access.
Prerequisites
Verify that:
- You have administrator permissions in Microsoft Entra ID.
- You have copied the Authorization Endpoint URL from Ivanti Access.
Procedure
- Sign in to the Microsoft Entra admin center.
- Go to Home > Authentication > App registrations, and then click New registration.
- Enter a user-facing display name for the application.
- Under Supported account types, select Single tenant only - Ivanti-ZSO.
- Under Redirect URI, select Web from the Select a platform drop-down, and then enter the Authorization Endpoint URL copied from Ivanti Access.
- Click Register. After registration completes, the overview page of the registered application appears.
- Copy the Application (client) ID and Directory (tenant) ID.
Next steps
Add the Entra ID MFA integration in Ivanti Access.
Adding the Entra ID MFA integration
Add the Entra ID MFA integration in Ivanti Access using the details of the application registered in Microsoft Entra ID.
Procedure
- In the Ivanti Access administrative portal, go to Profile > Entra ID MFA.
- Click Add MFA Integration.
- Enter a name for the integration.
- Enter the Application (client) ID in the Entra App ID field and the Directory (tenant) ID in the Entra Tenant ID field.
- Select the authentication methods to make available to users.
- Click Save.
- Expand the integration and copy the Client ID and Discovery Endpoint. You need these values to configure External MFA in Microsoft Entra ID.
When selecting authentication methods, note the following:
- No authentication method is selected by default.
- You must select QR Code, Push Notification, or both.
- If you select OTP, you must also select QR Code. OTP is activated in Ivanti Go only after the user scans the QR code for the first time.
- Tunnel Authentication cannot be enabled on its own. Select it together with QR Code or Push Notification.
If these conditions are not met, an error message appears when you save the integration.
When you create an integration, the default MFA policy is automatically assigned to it. You can assign a different policy later.
Rotating keys
Rotate the keys Ivanti Access uses to sign authentication responses to Microsoft Entra ID. Users authenticate the same way after rotation.
Procedure
- Under MFA Integrations, select Rotate Key from the Actions menu to rotate the authentication keys.
- Click Publish.
Key rotation takes approximately 72 hours to complete.
Next steps
Configure an Entra ID MFA policy, or continue with the default policy and configure External MFA in Microsoft Entra ID.
Configuring Entra ID MFA policies
Entra ID MFA policies determine how Ivanti Access evaluates authentication requests received from Microsoft Entra ID.
Procedure
- In the Ivanti Access administrative portal, go to the Entra ID MFA policy configuration page.
- Create a new Entra ID MFA policy.
- Enter the policy name and description.
- Add the required rules.
- Click Done.
- Assign the policy to the Entra ID MFA integration.
- Click Publish.
Next steps
Configure External MFA in Microsoft Entra ID.
Configuring External MFA in Microsoft Entra ID
Add Ivanti Access as an External MFA method in Microsoft Entra ID and associate it with the Entra ID MFA integration.
Prerequisites
Verify that:
- An Entra ID MFA integration is configured in Ivanti Access.
- You have administrator permissions in Microsoft Entra ID.
- The Client ID and Discovery Endpoint are available from the Entra ID MFA integration in Ivanti Access.
- The Application (client) ID of the application registered in Microsoft Entra ID is available.
Procedure
- Sign in to the Microsoft Entra admin center.
- Go to Authentication methods.
- Click Add external MFA.
- Enter the following details:
- Name: A display name for the method.
- Client ID: The Client ID from Ivanti Access.
- Discovery Endpoint: The Discovery Endpoint from Ivanti Access.
- Application ID: The Application (client) ID of the application registered in Microsoft Entra ID.
- Request admin consent by granting the required permissions.
- Click Save. A confirmation message appears.
- Select the newly created method, and then go to Enable and target > Enable > Save.
If an error appears while enabling the method, exit the screen and repeat the step.
Use Enable and target to assign the method to all users or to specific groups, based on your organization’s requirements.
Next steps
Register users for Ivanti Access MFA.
Registering users for Ivanti Access MFA
After the External MFA method is enabled, each user must register Ivanti Access as a sign-in method in their Microsoft account. Microsoft Entra ID prompts users for Ivanti Access only after they complete this registration. Until then, users continue to use their existing MFA method.
Notify the users who will use Ivanti Access to complete the following steps.
Prerequisites
Verify that:
- Ivanti Go is installed and registered on the user’s device.
- The External MFA method is enabled and targeted to the user.
Procedure (user)
- Go to mysignins.microsoft.com and sign in. Complete MFA using the existing method, such as Microsoft Authenticator.
- Go to Security info, and then click Add sign-in method.
- Select External MFA, and then select the Ivanti Access method configured by the administrator.
- When redirected to Ivanti Access, complete authentication using Ivanti Go.
After authentication succeeds, Ivanti Access is added as a sign-in method for the user.
Next steps
Create a Conditional Access policy in Microsoft Entra ID.
Creating a Conditional Access policy in Microsoft Entra ID
Create a Conditional Access policy in Microsoft Entra ID that requires MFA. Microsoft Entra ID redirects users to Ivanti Access only when a Conditional Access policy requires MFA for the sign-in.
Prerequisites
Verify that:
- You have at least the Conditional Access Administrator role in Microsoft Entra ID.
- A break-glass administrator account is available to exclude from this policy.
Procedure
- In the Microsoft Entra admin center, go to Conditional Access, and then click Create new policy. In the Azure portal, go to Security > Conditional Access > Policies.
- Enter a descriptive name for the policy.
- Under Assignments, click 0 users and groups selected, select the users or groups that should authenticate through Ivanti Access, and then click Select.
- Click Target resources. On the Include tab, click Select apps, and then select the applications that require Ivanti Access authentication.
- Optionally, add other conditions, such as client platform or network location.
- Under Access controls, click Grant, select Grant access and Require multifactor authentication, and then click Select.
- Set Enable policy to On, and then click Create. Microsoft Entra ID saves the policy and enforces MFA for the selected users and applications.
If users sign in to Ivanti Go using Microsoft Entra ID (federated sign-in), do not enable MFA for the Ivanti Go sign-in.
Test the policy with a small group of users and applications before you apply it to all users or all cloud apps. A policy applied too broadly, especially to administrators, can lock administrators out of the Microsoft Entra admin center.
Exclude a break-glass administrator account from this policy so that administrator access is never interrupted. Protect this account with a strong password and a separate control, such as restricting sign-in to a trusted network
Next steps
Restrict enrollment in alternative sign-in methods.
Restricting enrollment in alternative sign-in methods
To make Ivanti Access the sign-in method your users rely on, stop Microsoft Entra ID from prompting them to enroll in Microsoft Authenticator. After all users have added Ivanti Access as a sign-in method, you can turn off Microsoft Authenticator.
Make sure your Microsoft Entra and Azure administrators keep at least one native Microsoft authentication method registered as a fallback, so that emergency access to critical resources is never lost.
Prerequisites
Verify that you have at least the Authentication Policy Administrator role in Microsoft Entra ID.
Procedure
- In the Microsoft Entra admin center, go to Entra ID > Authentication methods > Registration campaign.
- Click Edit, set State to Disabled, and then click Save. Alternatively, keep the campaign active and exclude the user groups that use Ivanti Access.
- Go to Entra ID > Authentication methods > Settings > System preferred multifactor authentication. This prevents Microsoft Entra ID from prompting users for Microsoft Authenticator before Ivanti Access.
- Click Edit, set State to Disabled, and then click Save.
- After all users have added Ivanti Access as a sign-in method, go to Entra ID > Authentication methods > Policies, and then select Microsoft Authenticator.
- On the Enable and Target tab, turn off the Enable toggle. To keep Microsoft Authenticator as a fallback for administrators, leave it enabled and use the Include and Exclude tabs to target the administrator accounts that should keep it, or the user groups that should no longer use it.
- Click Save.
Next steps
Validate the configuration.
Validating the configuration
Verify the configuration using a user account registered for Ivanti Access MFA.
Prerequisites
Verify that:
- Ivanti Go is installed and registered for the user if QR Code, Push Notification, or OTP authentication is used.
- Ivanti Tunnel is configured if Tunnel Authentication is used.
- The device used to complete MFA is registered to the same user who completes primary authentication in Microsoft Entra ID.
Procedure
- Sign in to a Microsoft application using the user account.
- Complete primary authentication in Microsoft Entra ID.
- Complete any additional authentication prompts from Microsoft Entra ID.
- Verify that the user is redirected to Ivanti Access.
- Complete authentication using one of the configured methods.
- Verify that Microsoft Entra ID completes the sign-in and grants access to the requested application.