Microsoft Entra ID

Microsoft Entra ID (formerly Azure Active Directory) is Microsoft's enterprise identity platform. Mandaitor integrates with Entra ID for organizations in the Microsoft ecosystem, supporting multi-tenant applications, On-Behalf-Of delegation, and Workload Identity Federation.

When to Use Entra ID

Entra ID is the right choice when your customers use Microsoft 365, Azure, or Teams. Typical scenarios:

• Enterprise customers with Entra ID as their corporate directory
• Organizations using Microsoft 365 where employees delegate to AI agents
• Multi-tenant SaaS applications serving Microsoft-ecosystem customers
• AI agents running on Azure that need corporate identity context

Configuration

1. Register Mandaitor in Entra ID

Register as a multi-tenant application in the Azure portal:

az ad app create \
  --display-name "Mandaitor Delegation Registry" \
  --sign-in-audience "AzureADMultipleOrgs" \
  --web-redirect-uris "https://app.mandaitor.eu/auth/callback"

2. Configure Mandaitor

curl -X PUT https://api.mandaitor.io/v1/tenants/{tenantId}/identity-providers \
  -H "Authorization: Bearer $TOKEN" \
  -d '{
    "enabled_providers": ["API_KEY", "COGNITO", "ENTRA_ID"],
    "entra": {
      "tenant_id": "your-azure-ad-tenant-uuid",
      "client_id": "your-application-client-uuid"
    }
  }'

Token Validation

1. Provider detection: Authorizer detects login.microsoftonline.com issuer
2. JWKS verification: Signature verified against tenant-specific JWKS endpoint
3. Tenant validation: tid claim verified against configured tenant ID
4. Claims extraction: oid (Object ID), tid (Tenant ID), roles, scp, amr
5. Identity resolution: Mapped to oidc:entra:<oid>@<tid> canonical subject ID

The oid@tid format ensures uniqueness across Entra ID tenants — a user in Tenant A can never be confused with a user in Tenant B.

On-Behalf-Of (OBO) Flow

The OBO flow is the primary delegation mechanism for Entra ID:

Employee → Mandaitor Client → Mandaitor API → Downstream Service
    │              │                │                │
    │  Auth Code   │                │                │
    │─────────────>│                │                │
    │  Access Token│                │                │
    │<─────────────│                │                │
    │              │ Token Exchange │                │
    │              │───────────────>│                │
    │              │ Delegation     │ OBO Exchange   │
    │              │ Token          │───────────────>│
    │              │<───────────────│ Scoped Token   │
    │              │                │<───────────────│

// Employee authenticates with Entra ID via MSAL
const entraToken = await msalInstance.acquireTokenSilent({
  scopes: ["api://mandaitor/.default"],
});

// Exchange for delegation token
const delegation = await mandaitorClient.exchangeToken({
  subject_token: entraToken.accessToken,
  mandate_id: "mdt_abc123",
  audience: "https://graph.microsoft.com",
});

// AI agent uses the delegation token
console.log(delegation.delegation.principal); // Employee's oid@tid
console.log(delegation.delegation.delegate); // AI agent

Workload Identity Federation

For AI agents running outside Azure (AWS, GCP, on-premises), Workload Identity Federation allows authentication without managing secrets:

1. Configure a federated credential in Entra ID
2. The agent presents its native identity token
3. Entra ID exchanges it for an Azure token
4. Mandaitor verifies the Azure token and resolves the agent's identity

App Roles

Entra ID App Roles map to delegation authority:

App Role	Mandaitor Mapping
Delegation.Create	Can create mandates
Delegation.Approve	Can approve pending mandates
Agent.Manage	Can register and manage AI agents
Delegation.Admin	Full delegation administration

Roles are extracted from the roles claim in the Entra ID token.

Multi-Tenant Security

When operating as a multi-tenant application:

• The tid (Tenant ID) claim is validated on every request
• Mandates are scoped to the authenticated tenant
• A user from Tenant A cannot create mandates referencing resources in Tenant B
• Conditional Access policies are respected via the amr claim (MFA enforcement, device compliance)

SCIM Provisioning

Entra ID supports SCIM provisioning through the same /scim/v2/Users endpoints as Okta. Configure in Azure Portal:

1. Go to Enterprise Applications > Mandaitor > Provisioning
2. Set provisioning mode to Automatic
3. Set Tenant URL: https://api.mandaitor.io/v1/scim/v2
4. Set Secret Token: Your API key

User deprovisioning automatically revokes all active mandates.