skills.rest
webiny
webinyOFFICIAL
Explore all skills by this author →
Website𝕏@WebinyCMSGitHub

webiny-configure-entraid

Configures Microsoft Entra ID as a federated OIDC identity provider for Webiny via Cognito Federation.

8.0k|673|Updated Jan 9, 2018
Search Tags:#Authentication#sso#azure ad#OIDC#entra id#webiny#cognito federation
One-click install
npx skills add https://github.com/webiny/webiny-js --skill webiny-configure-entraid
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: webiny-configure-entraid
Source: https://github.com/webiny/webiny-js/tree/main/skills/user-skills/configure-entraid
Command: npx skills add https://github.com/webiny/webiny-js --skill webiny-configure-entraid

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires @webiny/cognito.

What problem does it solve?

Setting up Microsoft Entra ID (formerly Azure AD) single sign-on for a Webiny project requires coordinating Entra app registrations, Cognito federation settings, attribute mappings, and multi-step deployments, which is error-prone without a clear guide.

Core Features & Use Cases

  • Cognito Federation Setup: Add Entra ID as an OIDC identity provider through the <Cognito /> extension in webiny.config.tsx with client ID, client secret, and issuer URL.
  • Attribute and Role Mapping: Override default OIDC claim mappings and map Entra ID groups to Webiny roles and teams via a CognitoIdpConfig implementation.
  • Login Variants: Configure Entra-only login (hiding password forms), MFA, and multi-environment callback URLs for production deployments.
  • Use Case: An enterprise team wants employees to sign into the Webiny admin panel with their Microsoft 365 accounts, with Entra ID groups determining each user's Webiny role.

Quick Start

Ask the AI to configure Microsoft Entra ID login for your Webiny project using Cognito Federation with your Entra app registration credentials.

Frequently Asked Questions about webiny-configure-entraid

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I set up Microsoft Entra ID login for Webiny?▼

Register an app in the Microsoft Entra admin center, then add a `federation` config to the `<Cognito />` extension in `webiny.config.tsx` with your client ID, client secret, and issuer URL. Deploy core first, update the redirect URI, then deploy api and admin.

Does Entra ID replace Cognito in Webiny authentication?▼

No, Entra ID works alongside Cognito through federation, unlike Okta or Auth0 which replace Cognito entirely. Users authenticate via Microsoft, but Cognito remains the user pool.

How do I map Entra ID groups to Webiny roles?▼

Implement the `CognitoIdpConfig` interface from `@webiny/cognito/api` in an api.ts extension file. Read the `cognito:groups` claim from the JWT token and return the corresponding Webiny roles and teams.

Why does Entra ID login fail with custom:id attribute errors?▼

Entra ID `sub` values can exceed the 36-character max length of the `custom:id` attribute on existing Cognito pools. Fix it by providing a custom `attributeMapping` that omits the `custom:id` mapping.

Can I hide the password login and only show Microsoft sign-in?▼

Yes, set `allowCredentialsLogin: false` in the federation config. This hides the email/password form and displays only the "Sign in with Microsoft" button.

Related Skills

Explore More Software Engineering Skills→
microsoftmicrosoft
242

entra-app-registration

Register Microsoft Entra ID apps and configure OAuth/MSAL workflows.

Official
Intermediate
AzureADAzureAD
785

entra-id-aspire-provisioning

Provision Entra ID app registrations for .NET Aspire and update appsettings.json.

Official
Advanced
AcczdyAcczdy
2

implementing-azure-ad-privileged-identity-management

Implement Microsoft Entra PIM for just-in-time eligible role activations.

Community
Advanced
hung-phanhung-phan

saml

Analyze and optimize SAML 2.0 SSO configuration and security.

Community
Advanced