How to use Azure AD as external federated identity provider in AWS Cognito?
Published: 2023-03-15 01:28:00

**Steps in Azure:**
Azure AD — Navigate to Azure portal (https://portal.azure) and then search for “Azure Active Directory”

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/2qjpz166os0683hrgj8z.png)


2. Once you select the Azure Active Directory icon, then currently logged in Active Directory overview page will show.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/vfayay4krqy65znfrim5.png)



3. From the above overview page from left sidebar select “Enterprise applications” then page will open the overview screen, here we will create a new application. Now click “+ New application”

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/b9ube3h299e8j5ahmbo4.png)



Now click on “+ Create your own application” as shown below:

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/s8hzaqbk9k9gzxu3cynn.png)



Then provide a “name to your application” and select the default “Integrate any other application you don’t find in the gallery (Non-gallery)” option for the question “What are you looking to do with your application?” then click “Create”. Once application is created successfully it will appear in list as below:

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/nz2mtt7xo7p838krec2e.png)



4. To provide specific users and groups access to the application created above (named: “my-app”), click on the “my-app” it will open the overview page of your newly created application(“my-app”). Click on “Assign users and groups”

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/4qlkkb4e8sp3yu8rji5b.png)



5. Click on “+ Add User/Group”

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/oxc4easdnwk215h75olv.png)



Then select the Users (current/available users) or invite external users.

Note: if you invite the user then same user will be available for selection only after the user accepts the invite.


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/b4gqwd1idas8r5pupaoc.png)


6. After you have saved the selected user list then close. It will navigate to “my-app” overview page, then select “Get Started” from “Setup single sign on”.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ew0gcv16so6x85svokpp.png)



7. On this “SAML-based Sign-on” page set the “Identifier (Entity ID)” and “Reply URL (Assertion Consumer Service URL)” as shown below with format as mentioned below:

For Identifier (Entity ID) the format is:
urn:amazon:cognito:sp:<yourUserPoolID>
For example:
urn:amazon:cognito:sp:us-east-2_nYYYyyYyYy

For Reply URL the format is:
https://<yourDomainPrefix>.auth.<aws-region>.amazoncognito.com/saml2/idpresponse
For example:
https://test-cognito.auth.ap-southeast-2.amazoncognito.com/saml2/idpresponse

For more information, see Adding SAML Identity Providers to a User Pool in the Amazon Cognito Developer Guide.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ovjjzuswrm7vzc5k838e.png)



8. From same screen under “SAML Certificates” copy the “App Federation Metadata Url”, we will need this value while configuring AWS Cognito IdP.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/isnnix62r6ssq95r5mmi.png)



9. Click on “Edit” button next to “Attributes & Claims”, then copy the value of emailaddress/user.mail as highlighted below, we will need this as well during AWS Cognito IdP setup.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/zob4n1enqj7mfm1eq7nc.png)



**Steps in AWS Cognito:**
Create a user pool in AWS Cognito, follow the instructions to use the AWS Management Console to create a new user pool.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/l2gxwd0dnd7vme6uw4ho.png)



2. Add a domain name to user pool:

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/jypgopb8xe1ka4uaziut.png)



3. Then select “App Clients” from left sidebar


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/a7f7uqds3st0dpzg6eaa.png)


here we will create an app client , provide a client app “name ” and rest things keep them as default and click on “create app client”.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/jfqd0dfe510qryibwx1s.png)



4. Once “app client” has been created successfully. Navigate to “Identity Providers” as shown below, select “SAML”

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/lvyn274dsuxq4lb95opa.png)



here provide the “Provider name” and “metadata document url” that you copied from Azure AD setup then click on “Create provider”.


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/i92kuefrdx14jux3mipk.png)


5. Now navigate to “Attribute mapping” from left sidebar as shown below and select the IdP created above and then map the “SAML attribute” and “User pool attribute”.

Note: We have to provide the SAML attribute value that we copied from Azure AD setup.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/yp0are76b6sg6esn4qfn.png)



6. Navigate to “App client settings”, select the enabled IdPs and keep the settings(flows,scopes etc) as it is shown below & “Save”.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/lw96huq9216i4fz4c15f.png)



On same screen scroll down and click “Launch Hosted UI”

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/pvcgaz9o1twurptm9pdp.png)



7. If everything is done correctly you will be redirected to something like this as below and click on “AzureAD” and it will again redirect to microsoft screen it will ask you to login with AzureAD user details. once you are logged in successfully it will redirect back to provided “redirect_uri”, here in my case it was “http://localhost:3000/”

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/0es7rqqpyn2u86p7p0ou.png)



Final screen with code in querystring in redirected uri (http://localhost:3000/) will be as shown below:

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/jp3ec9ctx2sht3g7raj0.png)