External Tenant Features

@@ -2,8 +2,9 @@ title: External Tenant Features description: Compare features and capabilities of a workforce versus an external tenant configuration. Determine which tenant type applies to your external identities scenario. ms.topic: concept-article-ms.date: 03/30/2026+ms.date: 09/02/2026 ms.custom: it-pro, seo-july-2024, sfi-ropc-nochange+ai-usage: ai-assisted #Customer intent: As a dev, DevOps, or IT admin, I want to learn about features supported in a CIAM tenant so that I can configure tenants according to my organization's needs. --- @@ -67,7 +68,7 @@ The following table compares the [identity providers](../identity-providers.md) | Feature | Workforce tenant | External tenant | | ------- | ---------------- | --------------- | | Identity providers for external users (primary authentication) | For self-service sign-up guests:<ul><li>Microsoft Entra accounts</li><li>Microsoft accounts</li><li>Emailed one-time passcode</li><li>Google federation</li><li>Facebook federation</li></ul></br>For invited guests:<ul><li>Microsoft Entra accounts</li><li>Microsoft accounts</li><li>Emailed one-time passcode</li><li>Google federation</li><li>SAML/WS-Fed federation</li></ul> | For self-service sign-up users (consumers, business customers):<ul><li>[Authentication methods available in External ID](#authentication-methods-available-in-external-id)</li></ul></br>For invited guests (preview) via a directory role (for example, admins):<ul><li>Microsoft Entra accounts</li><li>Microsoft accounts</li><li>[Emailed one-time passcode](./concept-authentication-methods-customers.md#email-with-one-time-passcode-sign-in)</li><li>[SAML/WS-Fed federation](../direct-federation.md)</li></ul></br> You can invite external users for administrative purposes only. You can't use this feature to invite customers to sign in to your apps. This feature isn't compatible with customer identity and access management (CIAM) user flows. |-| Authentication methods for MFA | For internal users (employees and admins):<ul><li>[Authentication and verification methods](~/identity/authentication/overview-authentication.md)</li></ul></br>For guests (invited or self-service sign-up):<ul><li>[Authentication methods for guest MFA](../authentication-conditional-access.md#table-1-authentication-strength-mfa-methods-for-external-users)</li></ul> | For self-service sign-up users (consumers, business customers):<ul><li>[Emailed one-time passcode](concept-multifactor-authentication-customers.md#email-one-time-passcode)</li><li>[SMS-based authentication](concept-multifactor-authentication-customers.md#sms-based-authentication)</li><li>[Passkey (FIDO2)](how-to-sign-in-with-passkey.md)</li></ul></br>For invited users (preview):<ul><li>[Emailed one-time passcode](concept-multifactor-authentication-customers.md#email-one-time-passcode)</li><li>[SMS-based authentication](concept-multifactor-authentication-customers.md#sms-based-authentication)</li></ul> |+| Authentication methods for MFA | For internal users (employees and admins):<ul><li>[Authentication and verification methods](~/identity/authentication/overview-authentication.md)</li></ul></br>For guests (invited or self-service sign-up):<ul><li>[Authentication methods for guest MFA](../authentication-conditional-access.md#table-1-authentication-strength-mfa-methods-for-external-users)</li></ul> | For self-service sign-up users (consumers, business customers):<ul><li>[Emailed one-time passcode](concept-multifactor-authentication-customers.md#email-one-time-passcode)</li><li>[SMS-based authentication](concept-multifactor-authentication-customers.md#sms-based-authentication)</li><li>[Time-based one-time password (TOTP)](concept-multifactor-authentication-customers.md#time-based-one-time-password-totp)</li><li>[Passkey (FIDO2)](how-to-sign-in-with-passkey.md)</li></ul></br>For invited users (preview):<ul><li>[Emailed one-time passcode](concept-multifactor-authentication-customers.md#email-one-time-passcode)</li><li>[SMS-based authentication](concept-multifactor-authentication-customers.md#sms-based-authentication)</li></ul> |  ### Authentication methods available in External ID @@ -78,6 +79,7 @@ You can use some authentication methods as the primary factor when users sign in | [Email with password](./concept-authentication-methods-customers.md#email-and-password-sign-in) | :::image type="icon" source="../media/common/applies-to-yes.png" border="false":::  | :::image type="icon" source="../media/common/applies-to-yes.png" border="false":::  |  |  | | [Email one-time passcode](./concept-authentication-methods-customers.md#email-with-one-time-passcode-sign-in)| :::image type="icon" source="../media/common/applies-to-yes.png" border="false":::  | :::image type="icon" source="../media/common/applies-to-yes.png" border="false":::  |:::image type="icon" source="../media/common/applies-to-yes.png" border="false":::   | :::image type="icon" source="../media/common/applies-to-yes.png" border="false":::  | | [SMS-based authentication](./concept-multifactor-authentication-customers.md#sms-based-authentication)|  |  |  | :::image type="icon" source="../media/common/applies-to-yes.png" border="false":::  |+| [Time-based one-time password (TOTP)](./concept-multifactor-authentication-customers.md#time-based-one-time-password-totp)|  |  |  | :::image type="icon" source="../media/common/applies-to-yes.png" border="false":::  | | [Passkey (FIDO2)](./how-to-sign-in-with-passkey.md) | :::image type="icon" source="../media/common/applies-to-yes.png" border="false":::  |  |  | :::image type="icon" source="../media/common/applies-to-yes.png" border="false":::  | | [Apple federation](./how-to-apple-federation-customers.md)| :::image type="icon" source="../media/common/applies-to-yes.png" border="false":::  |:::image type="icon" source="../media/common/applies-to-yes.png" border="false":::   |  |  | | [Facebook federation](./how-to-facebook-federation-customers.md)| :::image type="icon" source="../media/common/applies-to-yes.png" border="false":::  | :::image type="icon" source="../media/common/applies-to-yes.png" border="false":::  |  |  |