AD/Entra Sync to Entra External ID

Question

AD/Entra Sync to Entra External ID

Christian Matras Stenderup 50

Hi all

We are setting up an Entra External ID, for enabling customer login on our customer sites.

We also have a separate Entra ID with employees, who should also be able to use their employee login on the customer sites. This is an on-prem AD synced to Entra ID.

As far as I can read, Entra External ID does not accept an Entra ID as an external Id provider?

Is it possible to utilize AD/Entra Connect Sync to synchronize the employee users on the Entra ID, into the External Entra ID?

Accepted answer

0 additional answers

Your answer

Answer 1

Marti Peig 970 Microsoft Employee

Hi @Christian Matras Stenderup ,

That is correct. You can find the supported IdPs for Entra External tenants in Identity providers for external tenants. You can create a self-service sing-up for your workforce users to be created in your external tenant. Check Create self-service sign-up user flows for apps in external tenants.

As usual, If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further queries do let us know.

I hope it helps.

Christian Matras Stenderup 50 Reputation points

2025-01-14T09:15:28.9833333+00:00

Hi @Marti Peig

Thank you for the response.

I might be misunderstanding your response, but the employees' users in the separate Entra tenant should not be able to sign up through my applications. They are added to the separate tenant as part of internal employee processes. That is why I hoped Entra Connect sync might be a way of adding them to our Entra External Tenant.

As a separate Entra tenant is not one of the predefined Identity providers, we looked into setting up the Entra tenant as a Custom OIDC identity provider. However, as is stated in the documentation Configure a new OpenID connect identity provider in the admin center:

"Configuring other Microsoft Entra tenants as an external identity provider is currently not supported. Consequently, the microsoftonline.com domain in the issuer URI is not accepted."
Marti Peig 970 Reputation points Microsoft Employee

2025-01-14T09:25:59.9533333+00:00

Hi @Christian Matras Stenderup

An Entra External ID tenant is a separate tenant from your workforce tenant. By default, your workforce members do not have access to it. That is why I suggested you to use the self-service sign-up process to create accounts for them in the external tenant.

You cannot use Entra Connect sync so populate identities in that B2C external tenant. Check Azure AD B2C: Frequently asked questions (FAQ)

Cheers
Christian Matras Stenderup 50 Reputation points

2025-01-14T10:41:03.26+00:00

Thank you for the response.

Hopefully for the future, adding a workforce tenant as External Identity provider will be an option in Entra External ID, as it was in Azure AD B2C: https://learn.microsoft.com/en-us/azure/active-directory-b2c/add-identity-provider
Christian Matras Stenderup 50 Reputation points

2025-01-14T11:40:31.78+00:00

Hi @Marti Peig

Do you know if it is on the roadmap to add Microsoft workforce tenants as External Identity providers to External tenants?
Marti Peig 970 Reputation points Microsoft Employee

2025-01-14T12:15:55.1766667+00:00

Hi @Christian Matras Stenderup

Not as far as I know. I would suggest keeping an eye on What's new in docs: External ID in external tenants for the more recent updates related to it.

Cheers

Share via

AD/Entra Sync to Entra External ID

0 additional answers

Your answer