Cross Tenant Authentication and User Impersonation on Entra External Id

Question

Cross Tenant Authentication and User Impersonation on Entra External Id

Bryan Berardi 40

I'm setting up Entra External Id for my project which has internal and external apps. I have an external tenant for customers on the external app, and a workforce tenant for the internal app.

We need to be able to impersonate customers on the external tenant and login to our external app as them. Is there any direction on how to do this with Entra External Id?

Navya 20,180 Reputation points Microsoft External Staff Moderator

2024-09-30T06:32:39.92+00:00

Hi @Bryan Berardi

Thank you for posting this in Microsoft Q&A.

I understand you have two separate tenants: one for external customers using the external app and another for the internal workforce using the internal app. You are looking for a way to authenticate workforce users to the external tenant and log in to your external app without creating users in external tenants.

Workforce tenant and External Tenant are different. A workforce tenant is designed for internal applications and resources, focusing on the organization's employees and partners. An External tenant is designed for external applications and resources, focusing on customers and customers.

For any new users to sign in to application in external tenant, first that users need to exist in the consumer tenant either by sign up or through invitation. Once these accounts exist in system, you can sign in to your application directly using user flow.

Cross tenant feature is not available in External tenant. Microsoft Entra External ID allows users from other tenants to directly sign-up using signUp/signIn user flow and added up as local accounts in consumer tenant. However, you can invite those users through email as well and then those accounts will consider as guest accounts.

Hope this helps. Do let us know if you any further queries.

Thanks,

Navya.

If the above is not your scenario, please correct me and provide us with detailed step.
Bryan Berardi 40 Reputation points

2024-09-30T13:29:45.8433333+00:00

Hi Navya,

That does answer my original question. As a follow up, if I add the internal users as guest accounts so they are able to authenticate, how would I go about attaching a claim at runtime for an OBO token so the external app knows on login who they wish to impersonate?

1 answer

Your answer

Navya 20,180 Reputation points Microsoft External Staff Moderator

2024-09-30T06:32:39.92+00:00

Hi @Bryan Berardi

Thank you for posting this in Microsoft Q&A.

I understand you have two separate tenants: one for external customers using the external app and another for the internal workforce using the internal app. You are looking for a way to authenticate workforce users to the external tenant and log in to your external app without creating users in external tenants.

Workforce tenant and External Tenant are different. A workforce tenant is designed for internal applications and resources, focusing on the organization's employees and partners. An External tenant is designed for external applications and resources, focusing on customers and customers.

For any new users to sign in to application in external tenant, first that users need to exist in the consumer tenant either by sign up or through invitation. Once these accounts exist in system, you can sign in to your application directly using user flow.

Cross tenant feature is not available in External tenant. Microsoft Entra External ID allows users from other tenants to directly sign-up using signUp/signIn user flow and added up as local accounts in consumer tenant. However, you can invite those users through email as well and then those accounts will consider as guest accounts.

Hope this helps. Do let us know if you any further queries.

Thanks,

Navya.

If the above is not your scenario, please correct me and provide us with detailed step.
Bryan Berardi 40 Reputation points

2024-09-30T13:29:45.8433333+00:00

Hi Navya,

That does answer my original question. As a follow up, if I add the internal users as guest accounts so they are able to authenticate, how would I go about attaching a claim at runtime for an OBO token so the external app knows on login who they wish to impersonate?

Answer 1

Mike Patnode 41

Is it not possible to setup the workforce tenant as an ODBC provider for the external tenant and thus be able to manage the workforce users?

Bryan Berardi 40 Reputation points

2025-03-01T19:38:14.1866667+00:00

At the time of the question, IdPs were severely limited in Entra External Id. It looks like as of this February 2025 (https://learn.microsoft.com/en-us/entra/fundamentals/whats-new#february-2025) they added support for SAML/WS-Feds (https://learn.microsoft.com/en-us/entra/external-id/direct-federation-overview), and OIDC is currently in preview (https://learn.microsoft.com/en-us/entra/external-id/customers/how-to-custom-oidc-federation-customers).

Looks like migrating to External Id from ADB2C with user impersonation could work now, we'd have to add code elsewhere to enable the impersonation. We already completed the lift so probably stick with B2C for now.

Share via

Cross Tenant Authentication and User Impersonation on Entra External Id

1 answer

Your answer