How to route users directly to a custom OIDC identity provider by email domain in an Entra External ID external tenant

Question

We have a Microsoft Entra External ID external tenant with custom OpenID Connect identity providers that federate to Microsoft Entra workforce tenants (one provider per organization).

Requirement: users from each organization should be taken straight to their own organization's sign-in page based on their email domain, without seeing the Microsoft account picker screen first, similar to how domain_hint works with SAML/WS-Fed domain federation.

What we have tested so far against the authorize endpoint:

1. Sending domain_hint with the domain part of the provider's issuer URI (login.microsoftonline.com) does accelerate directly to the provider. However, every Entra-backed OIDC provider has the same issuer host, so this cannot distinguish between multiple organizations.
2. The documentation for "Custom OIDC - Entra ID" says to use the domain name of the Entra ID tenant (for example contoso.onmicrosoft.com), but sending the federated tenant's onmicrosoft.com domain or its tenant ID as domain_hint does not accelerate, the account picker is still shown.
3. The Domains column shown for OIDC providers under External Identities appears to be read-only: there is no blade to edit it, and the oidcIdentityProvider resource in Microsoft Graph has no domain property.

Questions:

1. What is the supported way today to route each email domain to its own custom OIDC identity provider in an external tenant?
2. Is the recommended pattern one app registration plus a single-provider user flow per organization, so that provider selection happens through the client ID?
3. The OIDC identity provider GA announcement mentioned that domain-based federation and sign-in acceleration through domain hints are planned for OIDC. Is there any preview program for this, or a timeline?

Answer 1

Hello Chintan Sukhadiya,

Greetings! Thanks for raising this question in Q&A forum.

Based on the behavior you described, the limitation is that custom OpenID Connect (OIDC) identity providers in Microsoft Entra External ID do not currently support domain-based home realm discovery in the same way that SAML/WS-Fed federated domains supportdomain_hint. When multiple Entra-backed OIDC providers share the same issuer host, domain_hint cannot reliably distinguish between them.

1. Validate whether each organization can be mapped to a dedicated user flow or application registration. This is currently the most common workaround when provider-specific routing is required.
2. If you already know the user's organization before sign-in, pass the user directly to the appropriate user flow that contains only the required identity provider. This avoids the account picker experience.
3. Do not rely on the Domains column shown for OIDC providers, as it is not currently configurable through the portal or the Microsoft Graph oidcIdentityProvider resource.
4. If domain-based routing for custom OIDC providers is a hard requirement, this may require a product feature that is not generally available today.
5. Consider opening a Microsoft support case or feature request to confirm the latest product roadmap, preview availability, or supported design pattern for your scenario.

The next action is with Microsoft Support/Product Engineering. They can confirm whether domain-based sign-in acceleration for custom OIDC providers is currently supported, available in preview, or planned for a future release, and advise on the recommended architecture for multi-organization routing.

If this answer helps you kindly accept the answer which will help others who have similar questions.

Best Regards,

Jerald Felix.