On Entra External ID (EEID) federation with Entra ID

Federation Pavilion via Wikimedia

Questions around this particular federation are among the most popular on Q&A.

I was asked how to allow a customer to use their existing Entra ID to self-register on EEID.

Generally, this makes no sense. Your credentials are managed by an Entra ID instance, and you can’t hand this off to EEID.

If you have an Entra ID tenant contosoEID and an Entra External ID tenant fabrikamEEID, you can use “Create new external user” on fabrikamEEID to create a user called joe@contosoEID.onmicrosoft.com. But that user is a member of fabrikamEEID (local account) — not a federated one.

If you try to self-register with fabrikamEEID using joe@contosoEID.onmicrosoft.com, you will be asked to verify the OTP and enter the sign-up attributes configured for that user flow, but the user has a userType of “Member” and will therefore be a local account.

The user’s identity contains only the sign-in types of an email address and a UPN.

Note: This is now properly supported!!!! You don’t need a guest account.

The only way to get federation and use tenant contosoEID credentials is to create a guest account via email invite.

That account will have a userType of “Guest”, and the user’s identity contains only sign-in types of federated and a UPN.

This is clearly described in the docs:

“Note

The Microsoft Entra ID sign-up option is unavailable because, although customers can sign up for a local account using an email from another Microsoft Entra organisation, Microsoft Entra federation isn’t used to authenticate them. Google and Facebook become available only after you set up federation with them.”

So if the user signs up with joe@contosoEID.microsoft.com and uses the same contosoEID password, they can still log in, but if they change the contosoEID password, that won’t be reflected in fabrikamEEID.

You can add contosoEID as a custom OIDC identity provider to fabrikamEEID, but when you run the user flow, you won't see a federation button on the sign-in page to initiate the federation.

Essentially, EEID does not currently support OIDC federation to an onmicrosoft.com URL.

BTW, you can invite guests programmatically.

All good!