Tóm Tắt

Add Facebook as an identity provider for External Identities

Article
03/28/2021
4 minutes to read

You can add Facebook to your self-service sign-up user flows so that users can sign in to your applications using their own Facebook accounts. To allow users to sign in using Facebook, you’ll first need to enable self-service sign-up for your tenant. After you add Facebook as an identity provider, set up a user flow for the application and select Facebook as one of the sign-in options.

After you’ve added Facebook as one of your application’s sign-in options, on the Sign in page, a user can simply enter the email they use to sign in to Facebook, or they can select Sign-in options and choose Sign in with Facebook. In either case, they’ll be redirected to the Facebook login page for authentication.

Note

Users can only use their Facebook accounts to sign up through apps using self-service sign-up and user flows. Users cannot be invited and redeem their invitation using a Facebook account.

Create an app in the Facebook developers console

To use a Facebook account as an identity provider, you need to create an application in the Facebook developers console. If you don’t already have a Facebook account, you can sign up at https://www.facebook.com/.

Note

Use the following URLs in the steps 9 and 16 below.

For Site URL enter the address of your application, such as https://contoso.com.
For Valid OAuth redirect URIs, enter https://login.microsoftonline.com/te/<tenant-id>/oauth2/authresp. You can find your <tenant-ID> in the Azure Active Directory Overview blade.

Sign in to Facebook for developers with your Facebook account credentials.
If you have not already done so, you need to register as a Facebook developer. To do this, select Get Started on the upper-right corner of the page, accept Facebook’s policies, and complete the registration steps.
Select My Apps and then Create App.
Enter a Display Name and a valid Contact Email.
Select Create App ID. This may require you to accept Facebook platform policies and complete an online security check.
Select Settings > Basic.
Choose a Category, for example Business and Pages. This value is required by Facebook, but not used for Azure AD.
At the bottom of the page, select Add Platform, and then select Website.
In Site URL, enter the appropriate URL (noted above).
In Privacy Policy URL, enter the URL for the page where you maintain privacy information for your application, for example http://www.contoso.com.
Select Save Changes.
At the top of the page, copy the value of App ID.
Select Show and copy the value of App Secret. You use both of them to configure Facebook as an identity provider in your tenant. App Secret is an important security credential.
Select the plus sign next to PRODUCTS, and then select Set up under Facebook Login.
Under Facebook Login, select Settings.
In Valid OAuth redirect URIs, enter the appropriate URL (noted above).
Select Save Changes at the bottom of the page.
To make your Facebook application available to Azure AD, select the Status selector at the top right of the page and turn it On to make the Application public, and then select Switch Mode. At this point the Status should change from Development to Live.

Configure a Facebook account as an identity provider

Now you’ll set the Facebook client ID and client secret, either by entering it in the Azure AD portal or by using PowerShell. You can test your Facebook configuration by signing up via a user flow on an app enabled for self-service sign-up.

To configure Facebook federation in the Azure AD portal

Sign in to the Azure portal as the global administrator of your Azure AD tenant.
Under Azure services, select Azure Active Directory.
In the left menu, select External Identities.
Select All identity providers, then select Facebook.
For the Client ID, enter the App ID of the Facebook application that you created earlier.
For the Client secret, enter the App Secret that you recorded.
Select Save.

To configure Facebook federation by using PowerShell

Install the latest version of the Azure AD PowerShell for Graph module (AzureADPreview).
Run the following command:
Connect-AzureAD.
At the sign-in prompt, sign in with the managed Global Administrator account.
Run the following command:

New-AzureADMSIdentityProvider -Type Facebook -Name Facebook -ClientId [Client ID] -ClientSecret [Client secret]

Note

Use the client ID and client secret from the app you created above in the Facebook developer console. For more information, see the New-AzureADMSIdentityProvider article.

How do I remove Facebook federation?

You can delete your Facebook federation setup. If you do so, any users who have signed up through user flows with their Facebook accounts will no longer be able to log in.

To delete Facebook federation in the Azure AD portal:

Go to the Azure portal. In the left pane, select Azure Active Directory.
Select External Identities.
Select All identity providers.
On the Facebook line, select the context menu (…) and then select Delete.
Select Yes to confirm deletion.

To delete Facebook federation by using PowerShell:

Install the latest version of the Azure AD PowerShell for Graph module (AzureADPreview).
Run Connect-AzureAD.
In the sign-in prompt, sign in with the managed Global Administrator account.
Enter the following command:

Remove-AzureADMSIdentityProvider -Id Facebook-OAUTH

Note

For more information, see Remove-AzureADMSIdentityProvider.

Add Facebook as an identity provider – Azure AD – Microsoft Entra