01
First, identify the Entra scenario
Entra ID federation, B2B direct federation and External ID custom identity providers are not interchangeable setup paths. Supported protocols, routing and application behavior differ. Use Microsoft's documented configuration for your scenario, and validate a pilot before changing production sign-in policy.
There is no pre-built connector. Federation is standard OIDC or SAML 2.0 configuration on both sides. SenseCrypt IdP speaks both OpenID Connect and SAML 2.0, so the protocol follows the route Microsoft supports for your scenario rather than a preference on our side.
Your workforce
Federating a managed domain hands sign-in for that domain's users to an external identity provider. Entra accepts SAML 2.0 or WS-Federation for this; SenseCrypt IdP federates over SAML 2.0. A federation can be aimed at one group, so a pilot population moves first. Where the goal is an added factor rather than handing over sign-in, Microsoft's external authentication methods are the route to evaluate.
Guest users from a partner domain
B2B direct federation lets guests from another organization's domain sign in to your tenant with that organization's identity provider; with SenseCrypt IdP, the protocol is SAML 2.0. It covers guest access, not your own members.
Customers in an External ID tenant
An External ID customer tenant can add a custom OpenID Connect or SAML identity provider, which is how SenseCrypt IdP serves consumer sign-in behind Microsoft's customer identity platform.
02
What moves, and what stays
In every route, Entra ID keeps the directory, application assignment and the session it issues. What federates outward is the authentication event. SenseCrypt IdP runs the face ceremony on the enrolled phone and returns a signed token or assertion, which Entra ID validates before acting on anything inside it.
That event is where the attack pressure sits. Microsoft's 2024 Digital Defense Report recorded a 146 percent rise in adversary-in-the-middle phishing attacks, which relay a genuine sign-in through a proxy and steal what comes out of it. Origin binding addresses this relay threat, so compare the WebAuthn methods configured on both sides: on SenseCrypt IdP, phishing resistance belongs to the passkey method.
Conditional Access
Conditional Access still runs in Entra ID. Whether it treats the SenseCrypt IdP sign-in as satisfying an MFA requirement depends on the federation route; confirm this in your tenant before you rely on it.
Everything returned is signed
SenseCrypt IdP signs every ID token and every SAML response or assertion it issues, and Entra ID checks that signature against the published key. Trust is anchored in a verification key, not in a domain name anyone can imitate.
Attribute mapping decides what downstream sees
The claims SenseCrypt IdP emits, roles and permissions included, have to land on the Entra ID attributes your applications read. Bind on an identifier that survives a change of name or email address.
03
Getting the connection live
The SenseCrypt side is the same for every route. The Entra side follows Microsoft's current documentation for the scenario you identified, and that is the part to plan with your Microsoft administrators.
Prove the route with a disposable account and a physical handset before any policy points real people at it. Enrollment is the step teams consistently underestimate.
- Identify the scenario: workforce federation, B2B direct federation, or an External ID customer tenant.
- In the SenseCrypt IdP console, register a SAML service provider (or an OIDC application, where the route uses OpenID Connect) for your Entra tenant.
- Attach at least one SenseCrypt IdP group to the application; with none attached, nobody can sign in.
- Configure the Entra side using Microsoft's documented steps for that scenario, with the SenseCrypt IdP metadata file or discovery URL.
- Map the emitted claims and the user identifier to the Entra ID attributes your applications read.
- Turn on SCIM 2.0 if joiner and leaver changes should propagate without a ticket.
- Enroll one test account, complete a face sign-in on a real handset, and confirm how Conditional Access evaluated it.
04
What face sign-in will not do
The change removes the password and the one-time code from the routed sign-in. It does not remove the operational work around it.
05
SenseCrypt IdP at a glance
06
Frequently asked questions
Do we still need Entra ID after this?
Yes, and that is the design. Entra ID keeps the directory, evaluates Conditional Access and issues the session your applications consume. SenseCrypt IdP is the external identity provider it federates to for the authentication event.
Which protocol do we use?
The one Microsoft supports for your scenario. Workforce domain federation and B2B direct federation accept SAML 2.0 or WS-Federation, and SenseCrypt IdP uses SAML 2.0 for both; an External ID customer tenant accepts a custom OpenID Connect or SAML provider.
Can we pilot with one group?
It depends on the route. Workforce domain federation applies per domain, so a pilot is usually a test domain or Microsoft's staged-rollout controls rather than a group. Guest and External ID scenarios scope differently. Confirm the scoping option in Microsoft's documentation before you design the pilot.
Does the face sign-in count as MFA in Conditional Access?
Do not assume it. Whether Conditional Access treats a federated SenseCrypt IdP sign-in as satisfying an MFA requirement depends on the federation route and your tenant settings. Test it in your tenant before you rely on it.
Does anything need to be installed on user laptops?
No. The device being signed in to runs a browser and needs no enrollment, agent or extension. The SenseCrypt Authenticator app lives on the user's enrolled phone. Simple Webcam runs only in a licensed enterprise deployment, on secure terminals. Captures are processed inside that deployment, and the method adds no phone possession factor, so it is not multi-factor.
Can Windows sign-in itself use face sign-in?
SenseCrypt IdP authenticates browser-based and federated sign-ins, not the Windows desktop logon. If a specific desktop scenario is the goal, ask before assuming it is in scope: sales@seventhsense.ai.