Skip to main content

WebApp Authentication with Social Identity Providers (Google, Facebook & Apple ID)

Field
Details
Document Type
Runbook / How-To Guide
Applies To
Microsoft Entra ID External Identities (CIAM), Social Identity Providers (Google, Facebook, Apple), Third-party Web Applications 
Audience
Systems Administrators / Identity Engineers / 2nd Line Support
Author
AK. Udofeh
Last Updated
March 2026
Overview
This guide documents how to integrate Social Identity Providers (Google, Facebook, and Apple) with a SAML-based web application for authentication using Microsoft Entra ID External Identities and Customer Identity & Access Management (CIAM). The configuration allows users to authenticate using social accounts while Microsoft Entra acts as the identity broker and issues a SAML assertion to the third-party or line-of-business (LOB) web application.
The process involves creating an external tenant, registering social identity providers, creating a user flow, configuring a SAML enterprise application, and updating the application configuration.
The Issue
Organisations often require users to authenticate using Social Identities (e.g. Google or Facebook) while maintaining a centralised identity broker for security and policy enforcement.
Without a configured identity broker:
  • Applications must integrate individually with each social provider.
  • Identity attributes are inconsistent between providers.
  • Access control and auditing become difficult to manage.
Basic authentication methods such as:
  • Local application accounts
  • Direct OAuth integration within the application
do not provide centralised identity management or federation capabilities.
Using Microsoft Entra External Identities resolves this by brokering authentication from social providers and issuing a standard SAML assertion to the application.
Authentication via Socials IDP.png
Context
Modern applications often require authentication from multiple identity providers while maintaining centralised access control.
Without a broker, the authentication flow typically looks like this:
User
  ↓
Application
  ↓
Direct OAuth with Google/Facebook
This causes several issues:
  • Applications must implement provider-specific authentication logic
  • Identity attributes differ between providers
  • Access control cannot be centrally enforced
Using Microsoft Entra External Identities introduces an identity broker layer:
User
  ↓
Google / Facebook / Apple
  ↓  (OAuth / OIDC)
Microsoft Entra External Tenant (CIAM)
  ↓  (User Flow)
Enterprise Application (SAML)
  ↓
Flask Web Application
In this architecture:
  • Social providers authenticate the user.
  • Entra External Identities brokers the authentication.
  • A SAML assertion is issued to the web application.
Before You Start
Check
Where
External tenant created
Microsoft Entra admin centre
Azure subscription linked
Tenant creation wizard
Google Developer Console account
console.cloud.google.com
Meta Developer account
developers.facebook.com
Apple Developer account (optional)
developer.apple.com
SAML web application deployed
Flask service
Service Provider metadata configured
settings.json

Implementation Steps (Per Environment)

Phase 1 - Create External Tenant

Step 1: Sign in to the Microsoft Entra admin centre:
https://entra.microsoft.com 
Navigate to:
Microsoft Entra ID> Overview> Manage Tenants

Click:

Create> External
Enter the tenant details:
  • Tenant Name: <Your tenant name>
  • Domain Name: <Your domain name>
  • Location: Europe or Africa
  • Subscription: Azure subscription
Click:
Review + Create> Create
Provisioning may take up to 30 minutes.
Switch to the new tenant:
Settings> Directories + Subscriptions> Switch

Phase 2 -  Add Social Identity Providers

Navigate to:
External Identities
> All Identity Providers

Integrate with Google Identity Provider

Step 1: Configure Google OAuth
In Google Cloud Console:
APIs & Services
> Credentials
> OAuth2 Client ID
Fill in the Name of the Webapp
Add the Authorized redirect URI:
https://<tenant-subdomain>.ciamlogin.com/<tenant-subdomain>.onmicrosoft.com/federation/oauth2

Copy the following values and keep is save

> Client ID
> Client Secret
Step 2: Register Google as Idp in Entra ID
In Entra ID (Ext tenant directory) navigate to:
External Identities
> All Identity Providers
Enter:
Client ID
Client Secret
Click:
Save

Integrate with Facebook Identity Provider

Step 1: Create Meta Developer App
Visit to:
https://developers.facebook.com 
Select:
My Apps > Create App
Choose:
Authenticate and request data from users with Facebook Login
Select platform:
Web
Add redirect URI:
https://<tenant-subdomain>.ciamlogin.com/<tenant-subdomain>.onmicrosoft.com/federation/oauth2
In App Settings > Basic, copy:
App ID
App Secret
Add application domain:
<your domain here> (e.g: example.com)

Without adding the domain, Facebook login will fail with: "Can't load URL — domain isn't included in the app's domains"

Switch the application to:
Live Mode
Step 2: Register Facebook Idp in Entra ID
In Entra ID (Ext tenant directory) navigate to:
External Identities
> All Identity Providers
> + Facebook
Enter:
App ID
App Secret
Click:
Save

Integrate with Apple Identity Provider

Prerequisite: Apple Developer account

Step 1: Configure Apple Developer Portal
Navigate to:
https://developer.apple.com
Create an App ID with:
Sign in with Apple enabled
Create a Services ID
Example:
com.example.samllab
Configure redirect URI:
https://<tenant-subdomain>.ciamlogin.com/<tenant-subdomain>.onmicrosoft.com/federation/oauth2
Create Sign In with Apple Key
Download:
.p8 private key
Record:
Key ID
Team ID
Step 2: Register Apple Idp in Entra ID
In Entra ID (Ext tenant directory) navigate to:
External Identities
> All Identity Providers
> + Apple
Configure:
Client ID: Your Apple services ID
Apple developer team ID: Your Apple Team ID here
Key ID: Your Apple Key ID here
Client Secret: Upload the .p8 key file here

Phase 3: Create a User Flow

In Entra ID (Ext tenant directory) navigate to:
External Identities
> User Flows
> + New User Flow
Configure:
Name: (e.g) PilotApp-Auth-via-Socials
Enable identity providers:
Email with Password
Google
Facebook
Select attributes:
Display Name
Email Address
Given Name
Surname
Click:
Create

Phase 4: Register the SAML Application

Navigate to:
Enterprise Applications
> New Application
> Create Your Own Application
Name:
My PilotApp with Socials Idp
Select:
Integrate any other application you don't find in the gallery
Integrate any other application you don't find in the gallery

 

Back to top