This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(265.6, 37%, 35%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ECM%3C/text%3E%3C/svg%3E)
Hi all
We are setting up an Entra External ID, for enabling customer login on our customer sites.
We also have a separate Entra ID with employees, who should also be able to use their employee login on the customer sites. This is an on-prem AD synced to Entra ID.
As far as I can read, Entra External ID does not accept an Entra ID as an external Id provider?
Is it possible to utilize AD/Entra Connect Sync to synchronize the employee users on the Entra ID, into the External Entra ID?
Hi @Christian Matras Stenderup ,
That is correct. You can find the supported IdPs for Entra External tenants in Identity providers for external tenants. You can create a self-service sing-up for your workforce users to be created in your external tenant. Check Create self-service sign-up user flows for apps in external tenants.
As usual, If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further queries do let us know.
I hope it helps.
Hi @Marti Peig
Thank you for the response.
I might be misunderstanding your response, but the employees' users in the separate Entra tenant should not be able to sign up through my applications. They are added to the separate tenant as part of internal employee processes. That is why I hoped Entra Connect sync might be a way of adding them to our Entra External Tenant.
As a separate Entra tenant is not one of the predefined Identity providers, we looked into setting up the Entra tenant as a Custom OIDC identity provider. However, as is stated in the documentation Configure a new OpenID connect identity provider in the admin center:
"Configuring other Microsoft Entra tenants as an external identity provider is currently not supported. Consequently, the microsoftonline.com domain in the issuer URI is not accepted."
Hi @Christian Matras Stenderup
An Entra External ID tenant is a separate tenant from your workforce tenant. By default, your workforce members do not have access to it. That is why I suggested you to use the self-service sign-up process to create accounts for them in the external tenant.
You cannot use Entra Connect sync so populate identities in that B2C external tenant. Check Azure AD B2C: Frequently asked questions (FAQ)
Cheers
Thank you for the response.
Hopefully for the future, adding a workforce tenant as External Identity provider will be an option in Entra External ID, as it was in Azure AD B2C: https://zcusa.951200.xyz/en-us/azure/active-directory-b2c/add-identity-provider
Hi @Marti Peig
Do you know if it is on the roadmap to add Microsoft workforce tenants as External Identity providers to External tenants?
Hi @Christian Matras Stenderup
Not as far as I know. I would suggest keeping an eye on What's new in docs: External ID in external tenants for the more recent updates related to it.
Cheers