This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(89.60000000000001, 12%, 18%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EBB%3C/text%3E%3C/svg%3E)
I'm setting up Entra External Id for my project which has internal and external apps. I have an external tenant for customers on the external app, and a workforce tenant for the internal app.
We need to be able to impersonate customers on the external tenant and login to our external app as them. Is there any direction on how to do this with Entra External Id?
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(188.79999999999998, 26%, 28%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EN%3C/text%3E%3C/svg%3E)
Thank you for posting this in Microsoft Q&A.
I understand you have two separate tenants: one for external customers using the external app and another for the internal workforce using the internal app. You are looking for a way to authenticate workforce users to the external tenant and log in to your external app without creating users in external tenants.
Workforce tenant and External Tenant are different. A workforce tenant is designed for internal applications and resources, focusing on the organization's employees and partners. An External tenant is designed for external applications and resources, focusing on customers and customers.
For any new users to sign in to application in external tenant, first that users need to exist in the consumer tenant either by sign up or through invitation. Once these accounts exist in system, you can sign in to your application directly using user flow.
Cross tenant feature is not available in External tenant. Microsoft Entra External ID allows users from other tenants to directly sign-up using signUp/signIn user flow and added up as local accounts in consumer tenant. However, you can invite those users through email as well and then those accounts will consider as guest accounts.
Hope this helps. Do let us know if you any further queries.
Thanks,
Navya.
If the above is not your scenario, please correct me and provide us with detailed step.
Hi Navya,
That does answer my original question. As a follow up, if I add the internal users as guest accounts so they are able to authenticate, how would I go about attaching a claim at runtime for an OBO token so the external app knows on login who they wish to impersonate?