Azure CIAM OIDC Login Failing when authenticating Personal MS Accounts

Question

Hi,

We've setup a new Enterprise Application (in a new External Tenancy) that uses OIDC to authenticate external users and log them into our application. Via CIAM (using https://<TENNANTGUID>.ciamlogin.com), along with using Azure Entra External as the External User Authentication Store works great, no issue and the user can login successfully. However, when we then try to use Microsoft Live.com as the External Authentication Provider using a personal email addresses, we get the following error being produced as part of the OIDC flow and from page "https://login.live.com/oauth20_authorize.srf".

invalid_request: The provided value for the input parameter 'redirect_uri' is not valid. The expected value is a URI which matches a redirect URI registered for this client application.

This Relationship Flow is between the Azure CIAM Service and Live.com so we see no activity in our logs (either in azure or in our application) - we do not manage this relationship (this is managed by CIAM) so there is no ability for us to see/configure this redirect URL.

This is the redirect login that has all personal information substituted ;

https://login.live.com/oauth20_authorize.srf?scope=openid+profile+email+offline_access&response_type=code&client_id=XXXXXXX&response_mode=form_post&redirect_uri=https%3a%2f%2f<TENNANTGUID>.ciamlogin.com%2fcommon%2ffederation%2foauth2msa&state=XXXXXXXX&estsfed=1&uaid=XXXXXXXX&prompt=login&username=<PERSONAL EMAIL>&login_hint=<PERSONAL EMAIL>

Question: How can we continue to debug this, is it a (pretty big) bug With External Customer Authentication?

Note: When we use Google as the Authentication Provider, a similar error is given by Google (redirect url not correct).

Update1: We created the app again in a non external tenancy and the application now works as intended - the issue seems somewhere in CIAMLOGIN/External Tenancy - we are now exploring not using external tenancy/ciamlogin

Thanks.

Answer 1

Hello The personal-Microsoft-account (MSA) and Google flows fail because their apps don’t recognise the CIAM-tenant redirect URI. In an External (CIAM) tenant you must create your own app at each IdP and register the CIAM URLs Microsoft expects.

Refer:

Add MSA for customer sign-in - Microsoft Entra External ID | Microsoft Learn

Add Google as an identity provider - Microsoft Entra External ID | Microsoft Learn

Register them in the Live.com and Google developer portals, then paste the resulting client ID/secret back into External Identities → Identity providers.

You're right, Entra External (CIAM) automatically routes Microsoft personal accounts (MSAs) through live.com, and this behavior is currently enforced by design. Unlike other identity providers (Google, Apple, Meta), which are optional, MSAs are treated as first-party and cannot be disabled or overridden in the CIAM sign-in flow.

If this answers your query, do click Accept Answer and Yes for was this answer helpful, which may help members with similar questions.

If you have any other questions or are still experiencing issues, feel free to ask in the "comments" section, and I'd be happy to help.