Microsoft Entra External ID

Add OIDC for customer sign-in

In brief

Learn how to set up OpenID Connect as an external identity provider in Microsoft Entra External ID, enabling users to sign in using their existing accounts.

Documentation change

Known limitations

Conditional Access policies that require MFA registration don't function as expected when an External ID tenant is federated with an external identity provider (IdP). This can result in one of the following behaviors:

Issuer URI updates

  • Users are unable to register an MFA method and can't complete sign-in, often encountering an error.
  • Users aren't redirected to the MFA registration (sign-up) flow during sign-in as expected.

When you update the Issuer URI for an existing OIDC identity provider (IdP), the updated configuration might not automatically take effect in user flows. As a result, the IdP sign-in option might not appear on the sign-in page.

To apply the change:

  1. Disable the IdP in the user flow.
  2. Save the user flow.
  3. Re-enable the IdP.
  4. Save the user flow again.

Related content