Recommended OIDC and MFA setup with Microsoft Entra ID

[newbie1]

Hello

We are evaluating EspoCRM authentication through OIDC with Microsoft Entra ID.

Microsoft Entra ID would enforce multi-factor authentication through its own policies. We would like to understand the recommended EspoCRM configuration for this setup.

1. Should EspoCRM's native two-factor authentication be disabled for users authenticating through OIDC?
2. Is Microsoft Entra OIDC with Entra MFA considered a supported production configuration?
3. Can native EspoCRM authentication remain enabled for a local emergency administrator account?
4. How should multi-factor authentication be enforced for such a local emergency account?
5. Are there any known conflicts between forced EspoCRM 2FA and OIDC authentication?
6. Is it possible to prevent regular users from using local password authentication while retaining it for a designated administrator?

Thank you.

[yuri]

Hi,

2FA in EspoCRM is not compatible with OIDC, as stated in our OIDC docs.

> Is Microsoft Entra OIDC with Entra MFA considered a supported production configuration?

We do support OIDC, but we cannot be 100% sure that we support any possible combination. Please note that it's an open source product.

I suggest signing up to a personal demo or a cloud trial to test how it will work for your case.

https://docs.espocrm.com/administration/oidc/

[newbie1]

Thank you, understood. We will test the specific Microsoft Entra OIDC configuration and rely on Entra ID for MFA.

Could you please clarify one remaining point concerning emergency access?

When OIDC is enabled, can regular users be restricted to OIDC authentication while a designated local administrator continues to authenticate with an EspoCRM username and password?

If so, can EspoCRM's native 2FA be enabled only for this local administrator, or is native 2FA incompatible with OIDC at the entire instance level?

Thank you.

[yuri]

As the docs states: "Fallback login method. The ability to use the default Espo method. Can be enabled for admins or for both regular users and admins."

Meaning, you can enable the fallback only for admins. You can examine the OIDC configuration page in the demo, it may be helpful to understand the capabilities.

> can EspoCRM's native 2FA be enabled only for this local administrator,

You can enable 2FA in the system along with OIDC. But then, users who log in through OIDC should not set up 2FA for their account, only admins should.

[newbie1]

Thank you, this clarifies the intended setup.