How to add Entra and Microsoft as identity providers for External Id sign-up?

Question

Hi all,

I have an app setup and running in a workforce tenant. Using Entra External Id, I need to create an external tenant so that customers can sign-up to using their Entra accounts or personal Microsoft accounts (as well as other SSO providers in the future). However, neither of these are supported as in-built identity providers for the sign-up process.

The app registration for the external tenant is currently in single-tenant mode as, in multi-tenant mode, I get the following error trying to login: “AADSTS500207: The account type can't be used for the resource you're trying to access.”

My main questions are:

• Is the best approach to support Entra and personal Microsoft accounts as part of the self-service sign-up process to create a custom OIDC provider? If so, do I need separate providers for each and what should the configurations look like?
• Does my external tenant app registration need to be in multi-tenant mode? If so, could it be because the app registration doesn't have an MPN ID that I’m getting AADSTS500207 errors?

Any advice is greatly appreciated. Please, let me know if any further details are required.

Answer 1

Hello @Ash,

Please note that in External tenants, supported account types for creating Application Registration is only Single tenant.

Please refer to the below Screenshot for your reference.

Please note that currently using Microsoft accounts and Microsoft Entra accounts as an Identity Provider is supported only for Invited Guests and not supported for self-service sign-up users(consumers and business customers) in External tenant and in Workforce tenant, using Microsoft accounts and Microsoft Entra accounts as an Identity Provider is supported for both self-service sign-up users(consumers and business customers) as well as for Invited Guests.

Please refer to the below Screenshot for your reference.

So the best approach will be to use custom OIDC federation as an External Identity Provider for self-service sign-up users.

Please refer to the below documents which will be helpful.

Add OIDC for customer sign-in - Microsoft Entra External ID | Microsoft Learn

Add MSA for customer sign-in - Microsoft Entra External ID | Microsoft Learn

I hope this above information provided is helpful. Please feel free to reach out if you have any further questions.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".