Add Facebook as an identity provider for External Identities

Article
10/23/2023

Tip

This article describes adding Facebook as an identity provider for B2B collaboration. If your tenant is configured for customer identity and access management, see Add Facebook as an identity provider for customers.

You can add Facebook to your self-service sign-up user flows so that users can sign in to your applications using their own Facebook accounts. To allow users to sign in using Facebook, you'll first need to enable self-service sign-up for your tenant. After you add Facebook as an identity provider, set up a user flow for the application and select Facebook as one of the sign-in options.

After you've added Facebook as one of your application's sign-in options, on the Sign in page, a user can simply enter the email they use to sign in to Facebook, or they can select Sign-in options and choose Sign in with Facebook. In either case, they'll be redirected to the Facebook sign in page for authentication.

Note

Users can only use their Facebook accounts to sign up through apps using self-service sign-up and user flows. Users cannot be invited and redeem their invitation using a Facebook account.

Create an app in the Facebook developers console

To use a Facebook account as an identity provider, you need to create an application in the Facebook developers console. If you don't already have a Facebook account, you can sign up at https://www.facebook.com/.

Note

Use the following URLs in the steps 9 and 16 below.

For Site URL enter the address of your application, such as https://contoso.com.
For Valid OAuth redirect URIs, enter https://login.microsoftonline.com/te/<tenant-id>/oauth2/authresp. To find your tenant ID, sign in to the Microsoft Entra admin center. Under Identity, select Overview and copy the Tenant ID.

Sign in to Facebook for developers with your Facebook account credentials.
If you haven't already done so, you need to register as a Facebook developer. To do this, select Get Started on the upper-right corner of the page, accept Facebook's policies, and complete the registration steps.
Select My Apps and then Create App.
Select an app type and then Details
Add an app name and a valid App contact email.
Select Create app. This may require you to accept Facebook platform policies and complete an online security check.
Select Settings > Basic.
Choose a Category, for example Business and pages. This value is required by Facebook, but not used for Microsoft Entra External ID.
At the bottom of the page, select Add Platform, and then select Website.
In Site URL, enter the appropriate URL (noted above).
In Privacy Policy URL at the top of the page, enter the URL for the page where you maintain privacy information for your application, for example http://www.contoso.com.
Select Save changes.
At the top of the page, copy the value of App ID.
At the top of the page, select Show and copy the value of App secret. You use both of them to configure Facebook as an identity provider in your tenant. App secret is an important security credential.
In the left menu select Add Product next to Products, and then select Set up under Facebook Login.
Under Facebook Login in the left, select Settings.
In Valid OAuth redirect URIs, enter the appropriate URL (noted above).
Select Save changes at the bottom of the page.
To make your Facebook application available to Microsoft Entra External ID, select the App Mode selector at the top of the page and turn it Live to make the Application public.

Configure a Facebook account as an identity provider

Now you'll set the Facebook client ID and client secret, either by entering it in the Microsoft Entra admin center or by using PowerShell. You can test your Facebook configuration by signing up via a user flow on an app enabled for self-service sign-up.

To configure Facebook federation in the Microsoft Entra admin center

Tip

Steps in this article may vary slightly based on the portal you start from.

Sign in to the Microsoft Entra admin center as at least a External Identity Provider administrator.
Browse to Identity > External Identities > All identity providers, then select Facebook.
For the Client ID, enter the App ID of the Facebook application that you created earlier.
For the Client secret, enter the App secret that you recorded.
Select Save.

To configure Facebook federation by using PowerShell

Install the latest version of the Azure AD PowerShell for Graph module (AzureADPreview).
Run the following command: Connect-AzureAD.
At the sign-in prompt, sign in with the managed Global Administrator account.
Run the following command:

New-AzureADMSIdentityProvider -Type Facebook -Name Facebook -ClientId [Client ID] -ClientSecret [Client secret]

Note

Use the client ID and client secret from the app you created above in the Facebook developer console. For more information, see the New-AzureADMSIdentityProvider article.

How do I remove Facebook federation?

You can delete your Facebook federation setup. If you do so, any users who have signed up through user flows with their Facebook accounts will no longer be able to sign in.

To delete Facebook federation in the Microsoft Entra admin center:

Sign in to the Microsoft Entra admin center as at least a External Identity Provider administrator.
Browse to Identity > External Identities > All identity providers.
Select the Facebook line, and then select Delete.
Select Yes to confirm deletion.

To delete Facebook federation by using PowerShell:

Install the latest version of the Azure AD PowerShell for Graph module (AzureADPreview).
Run Connect-AzureAD.
In the sign-in prompt, sign in with the managed Global Administrator account.
Enter the following command:

Remove-AzureADMSIdentityProvider -Id Facebook-OAUTH

Note

For more information, see Remove-AzureADMSIdentityProvider.