Entra External ID - Can we sign in with our Workforce tenant as OIDC IdP?

Question

Hello,

I am currently setting up a Microsoft Entra External ID tenant to use for our customer-facing applications.

One of our requirements is to allow our internal employees (from our Entra Workforce tenant) to sign in to these same applications. I followed the documentation to configure a Custom OIDC Provider and added it to a user flow, but I noticed that Entra Workforce tenants (with microsoftonline.com issuer) are not accepted as an IdP.

My questions are:

1. Is support for using an Entra Workforce tenant as a custom OIDC IdP in Entra External ID available now?
2. If not, is there any roadmap or planned timeline for when this feature will be supported?
3. In the meantime, what is the recommended workaround — should we rely on guest invites, or is there another supported approach?

This scenario seems critical for many organizations that want to use External ID for CIAM while still enabling employees from their Workforce tenant to access the same apps.

Thank you in advance for your guidance.

Answer 1

Hello @Abd3ll3h,

Unfortunately, as of now you cannot federate an internal Workforce Microsoft Entra tenant as a Custom OIDC Identity Provider in an External ID tenant.

The UI and Graph APIs reject issuer URIs from microsoftonline.com as unsupported for custom OIDC federation.

Public Document: https://learn.microsoft.com/en-us/entra/external-id/customers/how-to-custom-oidc-federation-customers

Instead, there are other ways to enable collaboration or federation:

• Custom OIDC Federation Microsoft’s custom OIDC federation feature only supports identity providers that are not Entra tenants like social logins (Google, Facebook), Azure AD B2C, Microsoft personal accounts, or any OIDC-compliant service. Using another Entra ID tenant as an OIDC provider is not supported at this time.
• B2B Guest User Invitations can be another option. You can invite users from another Entra ID tenant to your External ID tenant as guests. To do this, go to your External ID tenant’s “External Identities” section, choose “Invite users,” and enter the users’ email addresses from the partner Entra tenant. The invited users get an email invitation, which they accept, and then appear as Guest users in your tenant.
• Another option is to use SAML/WS-Fed Direct Federation. If the partner tenant wants to federate using SAML or WS-Fed (older federation protocols), you can set this up for verified partner domains (like ******@partner.com). To do this, verify the partner’s domain in your tenant and add their SAML/WS-Fed identity provider metadata and certificate. When users sign in, they get redirected to their own tenant to authenticate and then return to your tenant after successful login.

As of now, there is no public roadmap indicating when support for Workforce tenant federation via OIDC will be added.

Unfortunately, we had hit the limitation, we always look to improve and would love to hear your thoughts. If you have any ideas or feedback on the feature in the question, please let us know your idea in the below given portal and our development team would be constantly monitoring them. https://feedbackportal.microsoft.com/feedback

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".