Getting a valid AMR with Entra as external IDP

Hello @IsaacB.81593 (Customer)​ Thank you for posting on our Community page!

For the OIDC setup you can review our documentation below:

https://developer.okta.com/docs/guides/social-login/microsoft/main/#

Please also see our documentation for SAML and WS-Fed below:

https://support.okta.com/help/s/article/Integrate-Microsoft-Entra-as-an-Identity-Provider-for-Okta-and-Vice-Versa?language=en_US

Thank you for reaching out to our Community and have a great day!

--

Help others in the community by liking or hitting Select as Best if this response helped you.

Updating this response for ease of access and reference:

When configuring Entra ID as an external Identity Provider (IdP) via OpenID Connect (OIDC), Okta does not map the Authentication Methods References (amr) claim by default. To pass the amr

claim to Okta and downstream applications, administrators must explicitly define the attribute in the Okta Profile Editor, use Entra ID v1.0 endpoints, and enable Authentication Claims Sharing.

Applies To

• Okta Identity Engine (OIE)
• Okta Classic Engine
• OpenID Connect (OIDC)
• Entra ID (External Identity Provider)

Solution

How is the attribute mapped in Okta?

Create a custom attribute in the Identity Provider profile and map it to the Okta user profile.

1. Go to Directory, and then select Profile Editor in the Okta Admin Console.
2. Locate the profile for the Entra OIDC Identity Provider and select Profile.
3. Select Add Attribute.
4. Enter amr in the External Name field. NOTE: This must match the exact claim name coming from Entra.
5. Enter amr or entra_amr in the Variable Name and Display Name fields.
6. Save the attribute.
7. Configure the Mappings to map the new Identity Provider attribute (appuser.amr) into the Okta user profile (user.entra_amr).

Entra ID endpoint compatibility requires v1.0 endpoints.

When Okta processes OIDC claims, Okta looks in the ID Token and the UserInfo endpoint. If administrators configure a UserInfo endpoint in the Okta Identity Provider setup, Okta ignores the ID token payload and only checks the UserInfo response for custom claims. A known compatibility issue exists when passing the amr claim from Entra ID via OIDC using Entra v2.0 endpoints. Entra ID v2.0 endpoints return an Access Token with an issuer claim that does not match the published OIDC configuration. If Okta attempts to validate this token to extract the amr claim, the authentication flow stops and prevents successful login.

Resolve this issue and successfully pull the amr claim by configuring the Okta Identity Provider with Microsoft Entra ID v1.0 endpoints.

• Authorize URL: https://login.microsoftonline.com/<Tenant-ID>/oauth2/authorize
• Token URL: https://login.microsoftonline.com/<Tenant-ID>/oauth2/token
• Issuer URL: https://sts.windows.net/<Tenant-ID>/
• JWKS Endpoint: https://login.microsoftonline.com/<Tenant-ID>/discovery/keys
• Userinfo Endpoint: https://login.microsoftonline.com/<Tenant-ID>/openid/userinfo

NOTE: Ensure that acceptMappedClaims is set to truein the Entra ID App Manifest.

How is Okta Claims Sharing configured?

Mapping the attribute is not sufficient to indicate to Okta that multifactor authentication (MFA) was already performed in Entra. Administrators must enable Authentication Claims Sharing. When this setting is enabled, Okta actively looks for the amr

array in the token. If the token contains MFA indicators from Entra, Okta satisfies the sign-on policy MFA requirements for that session.

Enable Authentication Claims Sharing to allow Okta to satisfy sign-on policy MFA requirements.

1. Open the Entra OIDC Identity Provider settings in the Okta Admin Console.
2. Select the Trust claims from this identity provider checkbox.

Related References

• Map Attributes from an External OIDC Identity Provider into the Okta User Profile
• Configuring Third-Party OIDC Claims Sharing
• Entra SAML Setup Video