Configure Microsoft Entra ID Authentication

TL;DR

Webiny supports Microsoft Entra ID (formerly Azure AD) as a federated identity provider through Cognito Federation. Unlike Okta or Auth0 which replace Cognito entirely, Entra ID works alongside Cognito, users authenticate via Microsoft, but Cognito remains the user pool. Configure it by adding federation to the <Cognito /> extension in webiny.config.tsx with your Entra ID application's client ID, client secret, and issuer URL.

Prerequisites

Before configuring Webiny, you need to register an application in the Microsoft Entra ID portal:

1. Go to Microsoft Entra admin center > App registrations > New registration
2. Set a name (e.g., "Webiny Admin")
3. Set Supported account types (typically "Accounts in this organizational directory only")
4. Set Redirect URI: Web, use your Cognito domain callback URL (you'll get this after the first deploy: https://{domain}.auth.{region}.amazoncognito.com/oauth2/idpresponse)
5. After registration, note:
   • Application (client) ID, this is your client_id
   • Directory (tenant) ID, part of your issuer URL
6. Go to Certificates & secrets > New client secret, note the Value (this is your client_secret)
7. The Issuer URL is: https://login.microsoftonline.com/{tenant-id}/v2.0

Reference Tables

Required Entra ID Values

Value	Where to find it	Used as
Application (client) ID	App registration > Overview	client_id in providerDetails
Client secret value	App registration > Certificates & secrets	client_secret in providerDetails
Directory (tenant) ID	App registration > Overview	Part of oidc_issuer URL