Entra External ID - Disable Local Signup while supporting Custom Identity Provider user creation

Josh Dinndorf 176 Reputation points
2025-08-27T15:05:32.9866667+00:00

We want to disable local signup but still support user creation from Custom Open ID Connect IdP providers.

This is possible in AzureB2C today. Is it possible in Entra External ID?

In Entra External ID we can disable sign up however this also prevents user creation from the identity providers when they login.

    {    
        "@odata.type": "#microsoft.graph.externalUsersSelfServiceSignUpEventsFlow",    
        "onInteractiveAuthFlowStart": {    
            "@odata.type": "#microsoft.graph.onInteractiveAuthFlowStartExternalUsersSelfServiceSignUp",    
            "isSignUpAllowed": false    
      }    
    }

Error when signup is disabled and federated user logs in. We expect this user to be seamlessly created like in AzureB2C yet prevent any user from just signing up with a local account.

AADSTS50020: User account 'demo' from identity provider 'demo' does not exist in tenant 'External ID' and cannot access the application 'app-id'(AppId - Dev) in that tenant. The account needs to be added as an external user in the tenant first. Sign out and sign in again with a different Azure Active Directory user account.

https://learn.microsoft.com/en-us/entra/external-id/customers/how-to-disable-sign-up-user-flow#disable-sign-up-flow

Microsoft Security | Microsoft Entra | Microsoft Entra External ID
0 comments
Answer accepted by question author
Anonymous
2025-09-02T05:07:53.7266667+00:00

Hello Josh Dinndorf,

Thank you for posting your query on Microsoft Q&A.
Based on your description I understood that You're asking whether it's possible in Microsoft Entra External ID to disable local sign-up while still allowing user creation via federated identity providers (IdPs), a behavior that works in Azure AD B2C today.
As of now, Entra External ID does not support automatic user creation from federated IdPs when sign-up is disabled.
In Entra External ID, when you set "isSignUpAllowed" to false, it does indeed prevent not just local signups but also the automatic creation of external users when they attempt to log in through identity providers (like your custom OIDC). This is why you're encountering the error stating that the user account does not exist in the tenant.

Unfortunately, as of now, there isn't a direct feature in Entra External ID that permits this configuration without additional handling.
However, you can post your feedback in our Azure feedback portal regarding the feature. 

https://feedback.azure.com/d365community/forum/22920db1-ad25-ec11-b6e6-000d3a4f0789

This channel is directly monitored by our PM's. They will look into this request and revert back to you directly with an update on this feature.

If the answer is helpful, please click "Accept Answer" and kindly upvote it.

Regards,
Monalisha

Was this answer helpful?

0 additional answers

Sort by: Most helpful
Most helpful Newest Oldest

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.