--- title: Configuring Entra ID MFA slug: access-guide/configuring-entra-id-mfa docTags: createdAt: 2026-10-23T14:02:11.370Z --- Entra ID MFA requires configuration in both Ivanti Access and Microsoft Entra ID. Complete the following topics in the order listed:  1. Copying the Authorization Endpoint URL  2. Registering an application in Microsoft Entra ID  3. Adding the Entra ID MFA integration  4. Configuring Entra ID MFA policies  5. Configuring External MFA in Microsoft Entra ID  6. Registering users for Ivanti Access MFA  7. Creating a Conditional Access policy in Microsoft Entra ID  8. Restricting enrollment in alternative sign-in methods  9. Validating the configuration  ### Copying the Authorization Endpoint URL  Copy the Authorization Endpoint URL from Ivanti Access. You need this URL to register an application in Microsoft Entra ID.  **Procedure**  1. In the Ivanti Access administrative portal, go to **Profile** > **Entra ID MFA**.  2. Copy the **Authorization Endpoint** URL displayed on the page.  **Next steps**  Register an application in Microsoft Entra ID.  ### Registering an application in Microsoft Entra ID  Register an application in Microsoft Entra ID to generate the Application (client) ID and Directory (tenant) ID required for the Entra ID MFA integration in Ivanti Access.  **Prerequisites** Verify that:  - You have administrator permissions in Microsoft Entra ID.  - You have copied the Authorization Endpoint URL from Ivanti Access.  **Procedure**  1. Sign in to the Microsoft Entra admin center.  2. Go to **Home** > **Authentication** > **App registrations**, and then click **New registration**.  3. Enter a user-facing display name for the application.  4. Under **Supported account types**, select **Single tenant only - Ivanti-ZSO**.  5. Under **Redirect URI**, select **Web** from the **Select a platform** drop-down, and then enter the Authorization Endpoint URL copied from Ivanti Access.  6. Click **Register**. After registration completes, the overview page of the registered application appears.  7. Copy the **Application (client) ID** and **Directory (tenant) ID**.  **Next steps**  Add the Entra ID MFA integration in Ivanti Access.  ### Adding the Entra ID MFA integration  Add the Entra ID MFA integration in Ivanti Access using the details of the application registered in Microsoft Entra ID.  **Procedure**  1. In the Ivanti Access administrative portal, go to **Profile** > **Entra ID MFA**.  2. Click **Add MFA Integration**.  3. Enter a name for the integration.  4. Enter the **Application (client) ID** in the **Entra App ID** field and the **Directory (tenant) ID** in the **Entra Tenant ID** field.  5. Select the authentication methods to make available to users.  6. Click **Save**.  7. Expand the integration and copy the **Client ID** and **Discovery Endpoint**. You need these values to configure External MFA in Microsoft Entra ID.  When selecting authentication methods, note the following:  - No authentication method is selected by default.  - You must select **QR Code**, **Push Notification**, or both.  - If you select **OTP**, you must also select **QR Code**. OTP is activated in Ivanti Go only after the user scans the QR code for the first time.  - **Tunnel Authentication** cannot be enabled on its own. Select it together with **QR Code** or **Push Notification**.  If these conditions are not met, an error message appears when you save the integration.  :::hint{type="info"} When you create an integration, the default MFA policy is automatically assigned to it. You can assign a different policy later. ::: ### Rotating keys  Rotate the keys Ivanti Access uses to sign authentication responses to Microsoft Entra ID. Users authenticate the same way after rotation.  **Procedure**  1. Under **MFA Integrations**, select **Rotate Key** from the **Actions** menu to rotate the authentication keys.  2. Click **Publish**.  :::hint{type="info"} Key rotation takes approximately 72 hours to complete.  ::: **Next steps**  Configure an Entra ID MFA policy, or continue with the default policy and configure External MFA in Microsoft Entra ID.  ### Configuring Entra ID MFA policies  Entra ID MFA policies determine how Ivanti Access evaluates authentication requests received from Microsoft Entra ID.  **Procedure**  1. In the Ivanti Access administrative portal, go to the Entra ID MFA policy configuration page.  2. Create a new Entra ID MFA policy.  3. Enter the policy name and description.  4. Add the required rules.  5. Click **Done**.  6. Assign the policy to the Entra ID MFA integration.  7. Click **Publish**.  **Next steps**  Configure External MFA in Microsoft Entra ID.  ### Configuring External MFA in Microsoft Entra ID  Add Ivanti Access as an External MFA method in Microsoft Entra ID and associate it with the Entra ID MFA integration.  **Prerequisites** Verify that:  - An Entra ID MFA integration is configured in Ivanti Access.  - You have administrator permissions in Microsoft Entra ID.  - The Client ID and Discovery Endpoint are available from the Entra ID MFA integration in Ivanti Access.  - The Application (client) ID of the application registered in Microsoft Entra ID is available.  **Procedure**  1. Sign in to the Microsoft Entra admin center.  2. Go to **Authentication methods**.  3. Click **Add external MFA**.  4. Enter the following details:  - **Name**: A display name for the method.  - **Client ID**: The Client ID from Ivanti Access.  - **Discovery Endpoint**: The Discovery Endpoint from Ivanti Access.  - **Application ID**: The Application (client) ID of the application registered in Microsoft Entra ID.  5. Request admin consent by granting the required permissions.  6. Click **Save**. A confirmation message appears.  7. Select the newly created method, and then go to **Enable and target** > **Enable** > **Save**.  :::hint{type="info"} If an error appears while enabling the method, exit the screen and repeat the step.  ::: :::hint{type="info"} Use **Enable and target** to assign the method to all users or to specific groups, based on your organization’s requirements.  ::: **Next steps**  Register users for Ivanti Access MFA.  ### Registering users for Ivanti Access MFA  After the External MFA method is enabled, each user must register Ivanti Access as a sign-in method in their Microsoft account. Microsoft Entra ID prompts users for Ivanti Access only after they complete this registration. Until then, users continue to use their existing MFA method.  Notify the users who will use Ivanti Access to complete the following steps.  **Prerequisites**  Verify that:  - Ivanti Go is installed and registered on the user’s device.  - The External MFA method is enabled and targeted to the user.  **Procedure (user)**  1. Go to **mysignins.microsoft.com** and sign in. Complete MFA using the existing method, such as Microsoft Authenticator.  2. Go to **Security info**, and then click **Add sign-in method**.  3. Select **External MFA**, and then select the Ivanti Access method configured by the administrator.  4. When redirected to Ivanti Access, complete authentication using Ivanti Go.  After authentication succeeds, Ivanti Access is added as a sign-in method for the user.  **Next steps**  Create a Conditional Access policy in Microsoft Entra ID.  ### Creating a Conditional Access policy in Microsoft Entra ID  Create a Conditional Access policy in Microsoft Entra ID that requires MFA. Microsoft Entra ID redirects users to Ivanti Access only when a Conditional Access policy requires MFA for the sign-in.   **Prerequisites**   Verify that:   - You have at least the Conditional Access Administrator role in Microsoft Entra ID.   - A break-glass administrator account is available to exclude from this policy.   **Procedure**   1. In the Microsoft Entra admin center, go to **Conditional Access**, and then click **Create new policy**. In the Azure portal, go to **Security** > **Conditional Access** > **Policies**.   2. Enter a descriptive name for the policy.   3. Under **Assignments**, click **0 users and groups selected**, select the users or groups that should authenticate through Ivanti Access, and then click **Select**.   4. Click **Target resources**. On the **Include** tab, click **Select apps**, and then select the applications that require Ivanti Access authentication.   5. Optionally, add other conditions, such as client platform or network location.   6. Under **Access controls**, click **Grant**, select **Grant access** and **Require multifactor authentication**, and then click **Select**.  7. Set **Enable policy** to **On**, and then click **Create**. Microsoft Entra ID saves the policy and enforces MFA for the selected users and applications.    :::hint{type="info"} If users sign in to Ivanti Go using Microsoft Entra ID (federated sign-in), do not enable MFA for the Ivanti Go sign-in.   ::: :::hint{type="info"} Test the policy with a small group of users and applications before you apply it to all users or all cloud apps. A policy applied too broadly, especially to administrators, can lock administrators out of the Microsoft Entra admin center.   ::: :::hint{type="info"} Exclude a break-glass administrator account from this policy so that administrator access is never interrupted. Protect this account with a strong password and a separate control, such as restricting sign-in to a trusted network  ::: **** **Next steps**  Restrict enrollment in alternative sign-in methods.  ### Restricting enrollment in alternative sign-in methods  To make Ivanti Access the sign-in method your users rely on, stop Microsoft Entra ID from prompting them to enroll in Microsoft Authenticator. After all users have added Ivanti Access as a sign-in method, you can turn off Microsoft Authenticator.  :::hint{type="info"} Make sure your Microsoft Entra and Azure administrators keep at least one native Microsoft authentication method registered as a fallback, so that emergency access to critical resources is never lost.  ::: **Prerequisites**  Verify that you have at least the Authentication Policy Administrator role in Microsoft Entra ID.  **Procedure**  1. In the Microsoft Entra admin center, go to **Entra ID** > **Authentication methods** > **Registration campaign**.  2. Click **Edit**, set **State** to **Disabled**, and then click **Save**. Alternatively, keep the campaign active and exclude the user groups that use Ivanti Access.  3. Go to **Entra ID** > **Authentication methods** > **Settings** > **System preferred multifactor authentication**. This prevents Microsoft Entra ID from prompting users for Microsoft Authenticator before Ivanti Access.  4. Click **Edit**, set **State** to **Disabled**, and then click **Save**.  5. After all users have added Ivanti Access as a sign-in method, go to **Entra ID** > **Authentication methods** > **Policies**, and then select **Microsoft Authenticator.** 6. On the **Enable and Target** tab, turn off the **Enable** toggle. To keep Microsoft Authenticator as a fallback for administrators, leave it enabled and use the **Include** and **Exclude** tabs to target the administrator accounts that should keep it, or the user groups that should no longer use it.  7. Click **Save**.  **Next steps**  Validate the configuration.  ### Validating the configuration  Verify the configuration using a user account registered for Ivanti Access MFA.  **Prerequisites**  Verify that:  - Ivanti Go is installed and registered for the user if QR Code, Push Notification, or OTP authentication is used.  - Ivanti Tunnel is configured if Tunnel Authentication is used.  - The device used to complete MFA is registered to the same user who completes primary authentication in Microsoft Entra ID.  **Procedure**  1. Sign in to a Microsoft application using the user account.  2. Complete primary authentication in Microsoft Entra ID.  3. Complete any additional authentication prompts from Microsoft Entra ID.  4. Verify that the user is redirected to Ivanti Access.  5. Complete authentication using one of the configured methods.  6. Verify that Microsoft Entra ID completes the sign-in and grants access to the requested application.