<iframe src="https://www.googletagmanager.com/ns.html?id=GTM-M74D8PB" height="0" width="0" style="display:none;visibility:hidden">
Loading
Skip to NavigationSkip to Main Content
0D51Y0000ARIC1sSQHOkta Classic EngineIntegrationsAnswered2021-03-16T11:02:06.000Z2021-02-08T13:59:43.000Z2021-02-08T14:14:09.000Z

GurpreetS.00338 (Customer) asked a question.

Okta OpenID Connect (OIDC) based IdP onboarding (inbound federation) of Azure AD based customers by using multitenant Azure AD OIDC app and global (/common) Azure AD endpoint

As Okta tenant admins, we need to onboard multiple Azure AD inbound federation based customers by adding Okta Generic OpenID Connect IdP, as given on below location:

https://developer.okta.com/docs/guides/add-an-external-idp/azure/create-an-app-at-idp/

 

Now, Azure AD supports multi-tenant apps where token requests are sent to a global endpoint that multiplexes across all Azure AD tenants: https://login.microsoftonline.com/common (here, in Azure AD multi-tenancy based apps, because the application doesn’t know up front what tenant the user is from, you can’t send requests to a tenant’s endpoint, so requests are sent to /common endpoint). Tenant and issuers (ISS) are different here based on which Id user enters and then which tenant Azure AD selects based on this info. This all can be read on below location:

https://docs.microsoft.com/en-us/azure/active-directory/develop/howto-convert-app-to-be-multi-tenant*understand-user-and-admin-consent

 

  1. Is there a way in Okta to consume such a global endpoint (/common) and multi-tenant based Azure AD IdP app, so that we don't have to register an app separately in each Azure AD tenant that we want to add/use as Okta OpenID Connect based IdP in our Okta tenant?
  2. Does Okta support such kind of global endpoint for okta based multi-okta-tenant apps?

This question is closed.
Loading
Okta OpenID Connect (OIDC) based IdP onboarding (inbound federation) of Azure AD based customers by using multitenant Azure AD OIDC app and global (/common) Azure AD endpoint