Login

r/entra

▲ 5 r/entra+1 crossposts

I built an OIDC Inspector that visualizes the auth flow — looking for feedback

Hey everyone,

I built OIDC Inspector, a tool for exploring an identity provider’s OpenID Connect configuration. Enter a domain or provider URL to inspect its endpoints, supported scopes, grant types, signing keys, and advertised PKCE support.

You can also visually see the interactions in the Authorization Code flow: the authorization request, redirect with a code, token exchange, UserInfo request, and API call. The sequence diagram uses the provider’s discovered endpoints to illustrate the flow.

The inspector is free to use, with no sign-up required: https://contextiq.trango-compute.com/dashboard/oidc-inspector

I’d appreciate feedback from anyone working with OAuth/OIDC, SSO, or identity integrations:

- Does the diagram make the flow easier to understand?

- What information would help you troubleshoot an integration?

- Are there providers or configurations it handles poorly?

I’m the maker, so candid criticism is welcome—especially anything confusing, missing, or technically inaccurate.

reddit.com
u/ContextIQ — 7 days ago
▲ 79 r/entra+1 crossposts

Microsoft Is Retiring the MemberOf Rule for Entra ID Dynamic Groups — Act Before November 2026

The MemberOf rule operator for dynamic groups in Entra ID is being retired. After November 3, 2026, any dynamic group, administrative unit, or entitlement management policy that still uses MemberOf just stops updating. Membership freezes in its last known state, no migration, no fallback.

This affects group-based licensing, Conditional Access targeting, Teams and SharePoint access, and access package assignments. For entitlement management policies, processing actually stops a week earlier on October 27.

You can find all affected groups with a single PowerShell command using a server-side Graph filter. The article also covers your replacement options and includes a practical example for group-based licensing without MemberOf.

More info: https://lazyadmin.nl/office-365/microsoft-entra-id-is-retiring-the-memberof-rule-for-dynamic-groups/

u/lazyadmin-nl — 9 days ago
▲ 3 r/entra

SCCM to Entra joined

We are planning to move from co-mgmt to Entra joined and I have questions.

  1. With co-mgmt we have the SCCM client installed and can see if a PC is online, on internet, in office or in VPN. How do you identify if a Entra joined device is on internet, in the office or on VPN without the SCCM client installed? From my understanding the SCCM client is not needed for Entra joined devices.

  2. Pinging a entra joined device when it’s in the office or in VPN, is this still possible?

  3. Are you able to view a remote (Entra joined) PC’s file structure from UNC path?

reddit.com
u/Constant-Position601 — 8 days ago
▲ 2 r/entra

Looking to move from Microsoft Identity Manager

We are currently using to Microsoft Identity Manager to share GALs. EOL for the product is in 2029 so we're looking to make our move soon.

Does anyone have any experience with Entra Cloud Sync as a replacement? Any pros/cons, suggestions, or anything to watch out for would be appreciated.

reddit.com
u/jddaynee — 8 days ago
▲ 10 r/entra

Admin SSPR

I have one of these issues that I swear is going to be so easy to fix that once someone points out problem i am going to have to lie down because it was so obvious - I hope.

As per MS Zero Trust they recommend that you disable SSPR for admins via update-mgpolicyauthorizationpolicy -allowedtousesspr:$false. Which works great and can see that on portal.

However if I logon it tries to register me for SSPR as the password reset enabled is targeted to All. I can obviously fix this by excluding a user manually from a dynamic group but that is not very flexible. In checking you cannot trap an administrator directly (suggest automation to populate a group or use manual extension attribute).

The actual issue is it pops up the ‘you must register SSPR’ then says no available methods but allows you to skip.

Is there an obvious miss from me?

reddit.com
u/Disastrous_Cup_3279 — 8 days ago
▲ 10 r/entra+1 crossposts

SAML - emit non-public attributes

creating a SAML SSO app is, I'm sure, routine.

you can customise claims; by default, they can include given name, surname, email address, UPN, etc

so far so good

more complicated - pizza topping

An SSO app needs a user's favourite pizza topping.

I set 'extensionAttribute1' to the pizza topping, and emit 'extensionAttribute1' to the SSO app.

any user can view any other user's 'extensionAttribute1' value [unless you break Teams]. So, Alice seeing Bob's favourite pizza topping isn't a problem.

even more complicated - date of birth

now, the app also wants the user's date of birth.

I can't store the user's date of birth 'extensionAttribute2', because that information shouldn't be public. anyone in Microsoft Entra ID can read any other user's extensionAttribute2.

I can add extension attributes. But they have the same problem; any user can read any other user's extension attributes. It is, after all, a directory, not a database, and directories are optimised for looking up information.

There is the concept of custom security attributes, and they can't be read. But you can't emit them in SAML attributes.

Marius has proposed a solution;

Issuing Custom Security Attributes in Entra ID tokens – Good Workaround! 

  • use custom security attributes
  • setup logic app as a custom security extension
  • the logic app can read the custom security attributes and add an OIDC claim

Sounds good in theory. I can't get it to work. There's almost nothing to see to be able to debug it.

Can I use Microsoft Entra External ID for this? It would...

  • store the date of birth
  • federate with Microsoft Entra ID for authentication; just like social logins

The UML sequence diagram shows how this could work;

  1. User logs in to the SSO app.
  2. SSO app redirects user to Microsoft Entra External ID. The user isn't authenticated, so Microsoft Entra External ID redirects the user to Microsoft Entra.
  3. The user authenticates (if necessary) and it emits 'public' attributes, such as first name, last name, email.
  4. The response from Microsoft Entra is sent to Microsoft Entra External ID.
  5. Microsoft Entra External ID adds the date of birth (from the user profile)
  6. Microsoft Entra External ID sends the SAMLResponse to the SSO app
  7. User is authenticated.

context

  • I can't write the date of birth directly into the SSO app; simply isn't possible
  • I would use Microsoft Graph to write the date of birth to Microsoft Entra External ID
  • (AD FS can work; but that means 'on prem' and 'AD DS'; want to avoid that)

I've dabbled with Azure AD B2C; it's pants. Everything is an XML document. Hoping Microsoft Entra External ID is easier.

Will this work? anyone done this?

Anyone got a better approach?

u/itproedu — 14 days ago
▲ 4 r/entra+1 crossposts

Issue joining Windows 11 devices to Entra (native Entra join - not hybrid)

We’ve got Entra Hybrid join working reliably and the enrolment to Intune takes place afterwards, so I know the Entra Device Settings and Intune Enrolment is configured correctly.

But I want to start moving away from this and natively joining Entra during OOBE or via Autopilot.

Here’s the rundown and the issue….

Windows 11 25H2 fresh image from ISO

During OOBE we select Join Work or School

Enter M365 username and password

Choose the account to join Entra

Just get spinning blue dots forever. No error message, no timeout.

Note: the user has a Business Premium licence, max number of devices is set to 50, no Device Registration Service entry appears in sign in logs. We have also excluded this user from Conditional Access and tried another user with the same result.

Note: I can join the exact same device without changing anything locally, to another tenant in exactly the same way and it works perfectly.

I think there is something wrong with the Device Registration Service on our tenant.

Anyone experienced the same issue and resolved it?

This has been logged with Microsoft but I’m not getting anywhere - they keep asking me the same basic questions and I’ve provided logs from the device. Not getting much help.

Thanks

https://preview.redd.it/sbtjzpcqqgth1.jpg?width=8064&format=pjpg&auto=webp&s=4b11df1bb3a102b3396d8403531fa132b4a912cf

reddit.com
u/iamBLOATER — 11 days ago