With the latest release of authd, users can now sign in to Ubuntu directly with their Microsoft Entra ID password and complete the MFA challenge required by their organisation.
Here’s what the new sign-in experience looks like in practice:
authd - Entra ID Password and MFA sign-in
Until now, signing in to Ubuntu with Entra ID required logging in on a second device: the Ubuntu login screen showed a code, and you completed the login in a browser on your phone or another computer.
The new flow is straightforward:
Enter your Entra ID password → complete the requested MFA challenge → continue to the Ubuntu desktop.
Supported challenges include approval through Microsoft Authenticator and one-time codes delivered by an authenticator application.
The Entra ID integration is built on libhimmelblau, which provides the core authentication and MFA functionality. authd integrates it with Ubuntu’s PAM and desktop login stack to support GDM, Polkit, terminal and SSH authentication.
The same authentication flow can also use passwordless sign-in methods available to the user, including Temporary Access Passes, Microsoft Authenticator and FIDO2 security keys.
This update also brings:
- More reliable handling of expired tokens and offline authentication.
- Clearer prompts across desktop, terminal and SSH sessions.
- Stronger validation of broker configuration.
- Automatic unlocking of the keyring.
- New authctl commands to manage user home directories and login shells, and to delete users and groups.
- Improved user and group management.
The new authentication flows are available in authd 0.7.0 and the Microsoft Entra ID broker 0.5.0 for Ubuntu 26.10, 26.04 LTS and 24.04 LTS releases through our PPA while archive updates are being prepared.
To get started, follow the authd installation guide, then see the configuration documentation to enable the entra_auth flow.
As always, feedback and bug reports are welcome in GitHub.