Add OIDC for customer sign-in
In brief
Learn how to set up OpenID Connect as an external identity provider in Microsoft Entra External ID, enabling users to sign in using their existing accounts.
Documentation change
Known limitations
Conditional Access policies that require MFA registration don't function as expected when an External ID tenant is federated with an external identity provider (IdP). This can result in one of the following behaviors:
Issuer URI updates
- Users are unable to register an MFA method and can't complete sign-in, often encountering an error.
- Users aren't redirected to the MFA registration (sign-up) flow during sign-in as expected.
When you update the Issuer URI for an existing OIDC identity provider (IdP), the updated configuration might not automatically take effect in user flows. As a result, the IdP sign-in option might not appear on the sign-in page.
To apply the change:
- Disable the IdP in the user flow.
- Save the user flow.
- Re-enable the IdP.
- Save the user flow again.
Related content
diff --git a/docs/external-id/customers/how-to-custom-oidc-federation-customers.md b/docs/external-id/customers/how-to-custom-oidc-federation-customers.md index a36a6ce3871..9d608be53c3 100644 --- a/docs/external-id/customers/how-to-custom-oidc-federation-customers.md +++ b/docs/external-id/customers/how-to-custom-oidc-federation-customers.md @@ -2,9 +2,10 @@ title: Add OIDC for customer sign-in description: Learn how to set up OpenID Connect as an external identity provider in Microsoft Entra External ID, enabling users to sign in using their existing accounts. ms.topic: how-to -ms.date: 09/15/2025 +ms.date: 07/29/2026 ms.reviewer: brozbab ms.custom: it-pro, msecd-doc-authoring-1012 +ai-usage: ai-assisted #customer intent: As a developer, devops, or it administrator, I want to learn how to add an OpenID Connect identity provider for my external tenant. --- @@ -112,10 +113,16 @@ At this point, you set up the OIDC identity provider in your Microsoft Entra ID, ## Known limitations -Conditional Access policies that require MFA registration don't function as expected when an External ID tenant is federated with an external identity provider (IdP). This can result in one of the following behaviors: +### Issuer URI updates -- Users are unable to register an MFA method and can't complete sign-in, often encountering an error. -- Users aren't redirected to the MFA registration (sign-up) flow during sign-in as expected. +When you update the Issuer URI for an existing OIDC identity provider (IdP), the updated configuration might not automatically take effect in user flows. As a result, the IdP sign-in option might not appear on the sign-in page. + +To apply the change: + +1. Disable the IdP in the user flow. +1. Save the user flow. +1. Re-enable the IdP. +1. Save the user flow again. ## Related content