entra-verified-id
starsforks
How to install entra-verified-id?
vinayaklatthe/microsoft-security-skills/entra-verified-id
$npx -y skills add vinayaklatthe/microsoft-security-skills --skill entra-verified-idGuidance for Microsoft Entra Verified ID — verifiable credentials issuance and verification platform based on open standards (W3C Verifiable Credentials, DIDs, OpenID4VC). Covers issuer setup (tenant configuration, DID registration, signing key in Key Vault), credential schema de
SKILL.md
| 1 | # Microsoft Entra Verified ID |
| 2 | |
| 3 | Entra Verified ID is Microsoft's verifiable-credentials platform built on open standards |
| 4 | (W3C Verifiable Credentials Data Model, Decentralized Identifiers, OpenID4VC). It lets an |
| 5 | organization **issue** signed digital credentials to anyone (employees, contractors, |
| 6 | customers) and **verify** credentials issued by others (Microsoft, governments, partners, |
| 7 | your own tenant) — without sharing user identity data over a backchannel. |
| 8 | |
| 9 | ## When to use |
| 10 | - High-confidence onboarding (remote new-hire identity proofing). |
| 11 | - Account recovery without help-desk calls. |
| 12 | - Cross-organization access (contractor with a VC from their employer). |
| 13 | - Vendor/partner identity proofing before privileged access. |
| 14 | - Customer scenarios needing portable, user-controlled credentials. |
| 15 | |
| 16 | **Do not use this skill** for B2C consumer auth (`entra-external-id`), standard workforce |
| 17 | identity (`entra-id`), or X.509 PKI (`pki-design`). |
| 18 | |
| 19 | ## Architecture in one paragraph |
| 20 | |
| 21 | Your tenant gets a **Decentralized Identifier (DID)**. A signing key in Key Vault produces |
| 22 | **Verifiable Credentials** following a **schema** (claims), with a **rules file** (how to |
| 23 | collect those claims at issuance) and a **display file** (visual presentation in the |
| 24 | wallet). Users hold credentials in **Microsoft Authenticator** (default wallet). A |
| 25 | **verifier** (any app/tenant) requests a credential via QR code or deep link, the wallet |
| 26 | presents it, the verifier validates the signature against the issuer's DID. Optional |
| 27 | **Face Check** asks the wallet to do a live selfie match against a photo claim in the VC. |
| 28 | |
| 29 | ## Approach |
| 30 | |
| 31 | 1. **Set up the issuer tenant.** |
| 32 | - Verify domain ownership (linked-domain proof attached to your DID). |
| 33 | - Provision a Key Vault and a signing key; grant Verified ID service permissions. |
| 34 | - Choose DID method: `did:web` (linked to your domain, recommended for enterprise) or |
| 35 | `did:ion`. |
| 36 | |
| 37 | 2. **Design the credential schema.** Start with one or two credentials, not ten: |
| 38 | - *Verified Employee* (name, employee ID, business unit, issue date). |
| 39 | - *Verified Trade Skill / Certification* (skill, expiry). |
| 40 | Avoid over-claiming — privacy and revocation churn grow with attributes. |
| 41 | |
| 42 | 3. **Pick an issuance attestation flow:** |
| 43 | - **ID Token (Entra)** — claims pulled from Entra ID after sign-in (fast for workforce). |
| 44 | - **ID Token Hint** — claims supplied by your app (custom data store). |
| 45 | - **Self-attested** — user enters claims (lowest assurance; rare). |
| 46 | - **Verifiable Credential** — claims sourced from another VC (re-issuance / step-up). |
| 47 | - **Identity verification partner** (e.g., LexisNexis, Onfido, IDEMIA via Microsoft |
| 48 | marketplace) — for true identity proofing during remote onboarding. |
| 49 | |
| 50 | 4. **Define revocation strategy** before issuance. Use the **status list 2021** approach |
| 51 | for bulk revocation. Plan for the lifecycle event: termination triggers a revocation |
| 52 | API call. |
| 53 | |
| 54 | 5. **Stand up a verifier app.** A web/mobile app generates a QR code → user scans with |
| 55 | Authenticator → app receives presentation. SDKs in .NET, Node.js, Java, Python. |
| 56 | |
| 57 | 6. **High-value use cases (start here):** |
| 58 | - **Remote onboarding**: candidate verifies identity via partner → receives a |
| 59 | *Verified Employee* VC → uses it for first-time TAP-less Entra ID setup, including |
| 60 | passkey provisioning. |
| 61 | - **Help-desk-less account recovery**: locked-out user presents Verified Employee VC → |
| 62 | reset MFA without ticket. |
| 63 | - **Face Check on privileged access**: high-impact admin actions trigger a Face Check |
| 64 | presentation request before authorization. |
| 65 | |
| 66 | 7. **Integrate with Conditional Access** via the |
| 67 | *Authentication context* + *Authentication strength* combination — CA can require a VC |
| 68 | presentation for sensitive resources. |
| 69 | |
| 70 | ## Guardrails |
| 71 | - **Treat the issuer signing key like a CA key.** Compromise lets attackers issue fak |
People who liked this also viewed
6 picksType
- entra-app-registrationGuides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API perSkillsJul 2026
- azure-complianceRun Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: SkillsJul 2026
- azure-rbacOfficial agent plugin providing skills and MCP server configurations for Azure scenarios.SkillsJul 2026
- better-auth-best-practicesAgent skill from better-auth/skillsSkillsJul 2026
- firebase-security-rules-auditorA skill to evaluate how secure Firestore security rules are. Use this when Firestore security rules are updated to ensure that the generated rules are extremely secure and robust.SkillsJul 2026
- audit-websiteAudit a website with the squirrelscan CLI and fix the findings in code. Runs SEO, performance, security, technical, content, accessibility, and 15 other rule categories (260+ rules), returns an LLM-opSkillsJul 2026
