Architecture

This section describes the technical design of Identity Stack. It is for architects, security reviewers, and administrators who plan an installation.

• Identity Stack Agent — the Windows services that connect Identity Stack to your on-premises Active Directory.

Components

Component	Where it runs	Function
BusinessID	Your self-service domain, for example https://id.domain.dk	The self-service portal. Users verify their identity, reset their password, and manage their sign-in methods.
Identity Stack API	Identity Stack cloud	Processes all requests from BusinessID and the integrations.
Microsoft Entra ID	Your Microsoft tenant	Holds the cloud accounts and the sign-in methods. Identity Stack uses the Microsoft Graph API.
Identity Stack Agent	Servers in your domain	Changes passwords and account state in your on-premises Active Directory.
MitID Erhverv	NemLog-in	Receives MitID Erhverv identities and roles. Identity Stack is a Local Identity Provider for MitID Erhverv.

Connections

All connections use TLS 1.2 or higher.

From	To	Protocol
The browser of the user	BusinessID and the Identity Stack API	HTTPS. Sign-in uses the OpenID Connect Authorization Code Flow with PKCE.
Identity Stack API	Microsoft Entra ID	Microsoft Graph API over HTTPS
Identity Stack Agent	Identity Stack API	HTTPS, outbound only. See Network requirements.
Identity Stack Agent	Your domain controllers	LDAPS
Identity Stack API	MitID Erhverv	HTTPS, with an OCES system certificate

Identity verification

A user must verify their identity before they can use BusinessID. Identity Stack supports two methods:

• MitID. The user signs in with their personal MitID. Identity Stack authorizes the user by their personal number (CPR).
• Passport or national ID card. The document must comply with ICAO 9303.

The user starts document verification in BusinessID on a computer. BusinessID then sends the user to a smartphone. The smartphone reads the document and compares the face of the user with the photo in the document.

Identity Stack then compares the document with the identity attributes of the user:

• Nationality
• Full name
• Date of birth
• Document number, such as the passport number, if Identity Stack has it

Access restrictions

You can limit access to BusinessID in two ways:

• IP address ranges. Only users on the IP address ranges that you specify get access.
• Microsoft Entra ID risk level. You set a maximum risk level: Low, Medium, or High. A user with a higher risk level does not get access.

For example, you can permit access only to users with the risk level Low or Medium.

Direct links

The password reset page has a direct link: https://id.domain.dk/recovery. See Company branding and links to self-service for the recommended company branding and self-service links in Microsoft Entra ID.

Password reset

Identity Stack changes the password in Microsoft Entra ID and in your on-premises Active Directory. The flow has four steps:

1. The user enters a new password. The password must comply with your password policy.
2. Identity Stack validates the password with the Microsoft Graph API (validatePassword).
3. Identity Stack Agent sets the password in your on-premises Active Directory. If the account is locked, the agent can also unlock it.
4. Identity Stack sets the password in Microsoft Entra ID with the Microsoft Graph API (passwordProfile).

Sign-in methods

After identity verification, the user can manage their sign-in methods in BusinessID. The user sees all their registered methods and the status of each method. The user can add, change, and remove methods. BusinessID works on computers and on mobile devices.

BusinessID supports these Microsoft sign-in methods:

• Microsoft Authenticator (push notifications)
• Windows Hello for Business
• Time-based one-time password (TOTP) applications and tokens
• Phone (SMS or voice call)
• Passkeys (FIDO2)

Identity Stack writes all changes to Microsoft Entra ID, so they apply immediately. Identity Stack validates and logs each change. Your Microsoft Entra ID policies still apply. For example, a policy can require a minimum number of methods or prevent the removal of a method.

MitID Erhverv

Identity Stack is a full-service Local Identity Provider (IdP) for MitID Erhverv. Users sign in to MitID Erhverv with their Microsoft Entra ID account and their Microsoft sign-in methods. The integration complies with NSIS (National Standard for Identity Assurance Services) and eIDAS. Identity Stack audits each authentication event.

Identity Stack also synchronizes to MitID Erhverv:

• MitID Erhverv identities. A new MitID Erhverv identity is ready for use immediately. Changes, such as a new role or the end of an employment, also go to MitID Erhverv.
• Roles and authorizations. You map groups in Microsoft Entra ID or Active Directory to MitID Erhverv roles. When a user joins or leaves a mapped group, Identity Stack adds or removes the role in MitID Erhverv.

See MitID Erhverv to set up the integration.