Sign in to the Azure Portal.

From the Home page, select Create a resource.

Search for and select Function App. Then select Create > Function App.

Create a function app with the following settings:

Select Review + create and then select Create. It may take a few minutes for Azure to deploy the function app.

Once deployed, select Go to resource.

In the Azure Portal, navigate to your function app.

In the function app’s Overview page, click Settings > Environment variables in the left navigation.

Click Add.

In the Add/Edit application setting pane, enter the following:

Click Apply.

On the Environment variables page, click Apply. Then click Confirm.

Navigate to the function app’s Overview page.

. In the Functions tab, and select Create function under Create in Azure portal.

Select the HTTP trigger template and select Next.

Enter a Function name and leave the Authorization level as Function. Then click Create.

Add the following code to the function:

const { Client, fql, FaunaError } = require("fauna");

module.exports = async function (context, req) {
    // Read the request body
    const requestBody = req.body;

    // Parse the request body
    const data = requestBody ? JSON.parse(requestBody) : null;
    const email = data?.data?.authenticationContext?.user.mail;

    const client = new Client({
      secret: process.env.FAUNA_SECRET,
    });

    const fauna_response = await client.query(fql`
      // If a Customer document with the email exists, get it.
      // Otherwise, create a Customer document.
      let user = Customer.byEmail(${email}).first() ??
        Customer.create({email: ${email}})
      // Create a token for the Customer document.
      let token = Token.create({
        document: user,
        ttl: Time.now().add(30, 'minutes')
      })
      // Return the Customer document's ID and the
      // token's secret.
      let payload = {
        userId: user!.id,
        token: token.secret
      }
      payload
    `);

    // Prepare the response object
    const response = {
        data: {
            '@odata.type': 'microsoft.graph.onTokenIssuanceStartResponseData',
            actions: [
                {
                    '@odata.type': 'microsoft.graph.tokenIssuanceStart.provideClaimsForToken',
                    claims: {
                        FaunaTokenSecret: fauna_response.data.token,
                    }
                }
            ]
        }
    };

    // Return the response
    context.res = {
        status: 200,
        body: response
    };
};

Save the function.

Click Get function URL.

Copy the default (Function key) URL.

In the top navigation, click Home.

Search for and select Microsoft Entra ID.

From the Entra Overview page, select Enterprise applications > Custom authentication extensions > Create a custom extension.

In the Basics tab, select the TokenIssuanceStart event type and click Next.

In the Endpoint Configuration tab, enter the following:

Select Next.

In API Authentication tab, you will be presented with an option to select a app registration type. Select Create new app registration.

Enter an application Name and select Next.

In the Claims tab, enter the following claim:

Select Next and then click Create.

In the top navigation, click Home.

Search for and select Microsoft Entra ID.

In the left navigation, select Manage > Enterprise applications.

Find and select the application you created from the list.

From the Overview page, select Manage >Single sign-on in the left navigation.

Next to Attributes & Claims, select Edit.

Expand Advanced settings.

Next to Custom claims provider, select Configure

In the Customer claims provider pane, select the custom claims provider you created earlier.

Click Save.

On the Attributes & Claims page, select Add new claim.

Enter a Name of FaunaTokenSecret.

Select a Source of Attribute.

Select a Source attribute of "customClaimsProvider.FaunaTokenSecret".

Select Save.

Open a new private browser and navigate and sign-in through the following URL.

https://login.microsoftonline.com/<TENANT_ID>/oauth2/v2.0/authorize?client_id=<CLIENT_ID>&response_type=id_token&redirect_uri=https://jwt.ms&response_mode=form_post&scope=openid&state=12345&nonce=678910

Replace:

After logging in, you’ll be presented with your decoded token at https://jwt.ms. The decoded token will contain the FaunaTokenSecret claim field.