Retrieving the x5c Parameter for Microsoft External Authentication Methods Apps in Okta

Microsoft External Authentication Methods (EAM) applications require the x5c parameter from the keys endpoint. By default, Okta does not return the x5c parameter for standard applications. Append the specific application client ID to the keys endpoint URL to retrieve this parameter.

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Microsoft External Authentication Methods (EAM)
• OpenID Connect (OIDC)

Retrieve the application client ID from the Okta Admin Console and append it to the authorization server keys endpoint URL to expose the x5c parameter.

1. Navigate to Applications > Applications in the Okta Admin Console.
2. Select the Microsoft EAM application.
3. Copy the client ID from the application URL.
    

4. Append the copied client ID to the standard keys endpoint URL using the client_id query parameter -

   Standard Authorization Server: https://<okta-domain>/oauth2/v1/keys?client_id=<client_id>

   Custom Authorization Server: https://<okta-domain>/oauth2/<authorization_server_id>/v1/keys?client_id=<client_id>

NOTE: Okta only returns the x5c parameter for EAM applications when using this specific query parameter. Standard applications do not receive the x5c parameter in the keys endpoint response.