Configure FaceLock Elevated MFA in Microsoft Entra ID

Step 1 — Confirm FaceLock MFA service availability

Before registering the method in Entra, confirm your environment's FaceLock MFA endpoint is reachable. The canonical FaceLock External MFA discovery URL (public OIDC metadata) is:

https://mfa.facelock.live/.well-known/openid-configuration

• Open https://mfa.facelock.live/.well-known/openid-configuration and verify issuer, authorization_endpoint, and jwks_uri are returned.
• Check https://mfa.facelock.live/health returns HTTP 200.
• Confirm your partner has mapped your Entra tenant ID (directory GUID) in the FaceLock Admin Portal MFA configuration.

Step 2 — Add FaceLock as an External Authentication Method

In the Microsoft Entra admin center, register FaceLock using OpenID Connect discovery (External Authentication Methods).

1. Sign in to Microsoft Entra admin center → Protection → Authentication methods → Policies → Add external method (or External authentication methods).
2. Choose Add method → External authentication method (OIDC-based).
3. Display name: FaceLock Elevated MFA (or your organization's preferred label).
4. Discovery URL: paste the FaceLock OIDC discovery URL provided by your partner (production example below).
5. Save and enable the method for the target users or groups.

You only paste the discovery URL — Entra discovers authorization_endpoint, token behavior, and JWKS automatically. Redirect URIs and OIDC signing are configured on FaceLock's platform External MFA app registration, not in your tenant.

Step 3 — Scope the method to verified domains (if prompted)

When Entra asks which domains should use the external method, limit scope to the domains where you will roll out FaceLock (for example contoso.com). This is especially important for organizations with multiple verified domains. Your FaceLock partner can record the same domain list in the tenant MFA integration settings for routing and support.

Step 4 — Create or update a Conditional Access policy

External MFA methods only take effect when required by Conditional Access. Create a staged policy before broad rollout.

1. Entra admin center → Protection → Conditional Access → New policy.
2. Name: Require FaceLock Elevated MFA (pilot).
3. Users: start with a pilot security group; exclude break-glass emergency accounts.
4. Cloud apps: Microsoft Entra ID (or specific apps such as Office 365).
5. Grant: Require authentication → select FaceLock / External authentication method (or add to an authentication strength that includes phishing-resistant methods).
6. Enable policy: Report-only for initial validation, then On.

For regulated environments, align the policy with your authentication strength requirements (phishing-resistant MFA) and document break-glass account exclusions.

Step 5 — User enrollment and first sign-in

On first sign-in after the policy applies, Entra redirects the user to FaceLock for biometric enrollment (if not yet enrolled) or verification (if already enrolled).

1. User signs in to Entra and is prompted for additional authentication.
2. Entra federates to FaceLock; the user completes 3D liveness in the FaceLock Authenticator app (push) or browser flow as configured.
3. FaceLock returns a signed id_token with amr:["face"] to Entra; sign-in completes if Conditional Access is satisfied.
4. Verify the sign-in log shows the external method and MFA satisfaction.

Resellers can pre-provision users via the FaceLock Admin Portal (provision enrollment codes) so the first Entra sign-in routes directly to verification instead of enrollment.

Step 6 — Partner portal tenant mapping (your FaceLock partner)

Before production sign-in, your FaceLock partner saves a Tenant MFA integration in Admin Portal → Tenant → MFA Configuration. This links your Entra directory GUID to the correct FaceLock tenant for routing, billing, and support:

• Vendor: Microsoft Entra ID
• External directory ID: your Entra tenant GUID (tid) — required
• OIDC client ID: FaceLock External MFA application ID (6ec30e4d-87de-4bdd-bd6c-ecd3133ad1c8) — reference only; you do not register this app in your tenant
• Issuer URL: optional metadata (e.g. https://login.microsoftonline.com/{your-tid}/v2.0)
• Verified domains: one domain per line when one Entra tenant serves multiple domains

The Certificates & secrets entry used for self-serve ZeroProof enrollment tooling is a separate FaceLock-operated Graph app (User.Read.All) and is not part of your External MFA method setup.