Microsoft Entra External ID user flow returns 403 Forbidden — tenant appears not provisioned

Question

I have a tenant fully configured to use Microsoft Entra External ID. A valid Azure subscription is linked, and a Developer Support Plan is active on the subscription.

We’ve created a self-service sign-up user flow, enabled identity providers, and registered our application properly. However:

• All '/authorize' endpoints using the 'p=' query return 403 Forbidden
• Graph API call to '/identity/b2xUserFlows/B2X_1_devSportHubSignupFlow/assignedApplications' fails with: { "error": { "code": "BadRequest", "message": "Resource not found for the segment 'assignedApplications'." } }
• Microsoft Entra governance features like Access Reviews also return a 403 error tied to 'Microsoft_AAD_ERM', suggesting that backend provisioning is not complete.
• We have linked our subscription to Entra External ID in the “Linked Subscriptions” blade, but the backend enforcement engine (policy object required for token issuance) is not there.

Screenshots and diagnostics are available on request.

I am hoping that someone from Microsoft can manually provision or repair the backend identity policy enforcement infrastructure for External ID on this tenant so that user flow-based login and token issuance can work.

Thank you!

Answer 1

Hi @Dustin Crockett

I understand you're encountering issues with the configuration and provisioning of the backend identity policy enforcement infrastructure for Microsoft Entra External ID in your tenant.

1.Please ensure that the permissions and configurations for the self-service sign-up user flow and identity providers are correctly set up.

2.For the /authorize endpoints returning 403 errors, verify that access control settings and policies are correctly configured.

3.Regarding the Graph API call to /identity/b2xUserFlows/B2X_1_devSportHubSignupFlow/assignedApplications: The error message "Resource not found for the segment 'assignedApplications'" suggests that this endpoint may be invalid or inaccessible. Please double-check the endpoint syntax and parameters and ensure the application making the call has the necessary permissions.

4.For Microsoft Entra governance features: The 403-error related to 'Microsoft_AAD_ERM' indicates potential access or permission issues tied to governance components. Review the access control and role assignments required to use these features.

Could you please share the screenshot to understand issue better.

Hope this helps. Do let us know if you any further queries.