This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(112.00000000000001, 76%, 20%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ERC%3C/text%3E%3C/svg%3E)
HOURS AND HOURS wasted on this, tried 7 external tenants, from 4 Workforce tenants. Diabolical non existent support from Microsoft. 'Keep Trying' advised on one ticket, a joke, more than a week wasted an now no where. Identity not even mentioned in ticket child options!
Both CIAM tenants (ACCESSIRS cf058f67‑…, IRSLOBBY 8299aefb‑…) are missing the Customer identity UI. External Identities ▸ Customer identity / User flows / Identity providers blades all fail with ErrorLoadingExtensionAndDefinition. Graph confirms tenantType = "CIAM", but CIAM does not expose user‑flow management APIs, so there is no programmatic workaround. STS is live (tokens from *.ciamlogin.com work; Power Pages creates Contacts), but we cannot enable Local Accounts (signup) because the CIAM UI never loads. Please complete/repair CIAM provisioning so the Customer identity blades render and we can attach the Local Accounts provider.
Managing external identities to enable secure access for partners, customers, and other non-employees
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(201.6, 99%, 29%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ER%3C/text%3E%3C/svg%3E)
Hello
Thank you for sharing the details, we will check internally and get back to you shortly!
Richard Collins The directory itself is provided appropriately since tenantType = "CIAM" is verified and token issuance from *.ciamlogin.com is operational. It is evident that the CIAM management extension has not been fully initialized for certain tenants when External Identities → Customer identity / User flows / Identity providers fail with ErrorLoadingExtensionAndDefinition. Local Account configuration cannot be done using a graph-based workaround since CIAM does not disclose user-flow management APIs.
Thank you for trying an answer but it is the same as my question. It has failed to provision so is not 50% good but 100% unusable?
Richard Collins You're right; this isn't just partially working. The tenant is completely unsuitable for CIAM situations even when the STS endpoint is issuing tokens because: There is no loading of the Customer Identity UI. It is not possible to construct or manage user flows. It is not possible to configure identity providers. It is not possible to enable local accounts (signup/signin).
A Graph/API workaround for CIAM user-flow management does not exist. If the Customer Identity blades do not render, the tenant cannot be configured for real-world use. Token issuance alone does not make the tenant operational.
I think that when CIAM keeps blankin like that the ext‑def just never bound clean to the tenant’s polSvc. u can flip portal region or open in priv wndw to force a fresh ext‑pull, but if the polSvc map’s empty MS has to re‑seed it. if I’m wrong, sorry.