Entra External ID - Domain Hint for Custom OpenID Connect IDPs

Question

Entra External ID - Domain Hint for Custom OpenID Connect IDPs

Josh Dinndorf 176

I am expecting Entra External ID to support the query parameter domain_hint for HRD i.e. login straight to the Custom OpenID Connect IDP without having to select

domain_hint=login.live.com works for MS accounts

https://wggdemo.ciamlogin.com/818fbfd7-0338-45d3-8cc8-8d521cc578b2/oauth2/v2.0/authorize?client_id=10....domain_hint=login.live.com

however anything I try for custom idp does not.

In AzureB2C this works as expected allowing to specify the domain to IDP

<Domain>customidp.com</Domain>

Does Entra External ID support this? If so what domain hint should be used from the Custom IDP configuration?

The Entra demo states

"The domain_hint parameter is an optional query parameter that can be added to the authorization request URL. It indicates to Microsoft Entra external ID which domain the user should use for signing in. When included, the user will bypass the Microsoft Entra external ID sign-in page and proceed directly to the external identity provider's sign-in page. This feature is currently in preview and available only for Custom OpenID Connect IDPs"

https://woodgrovedemo.com/#usecase=DomainHint

Martin Kallukalam 555 Reputation points

2025-09-08T02:25:47.2066667+00:00

same problem here. domain hint works with SAML but not with OIDC
Josh Dinndorf 176 Reputation points

2025-09-08T15:34:50+00:00

MS Support got back to me and mentioned this is not supported. No comment on if it will ever be supported and/or when....

We are flipping to another 3rd party solution here as Entra External ID is not ready to replace Azure B2C and MS is not able to address these missing features.

"Upon receiving your request, I've had an internal discussion with my team and also created an internal ticket to consult with our higher engineers.

Unfortunately, at the moment, External ID doesn't support domain hint parameter yet. "

Answer accepted by question author

David Macía 100

This is an old post, but just for the record if someone faces the same issue. I was able to make the domain_hint work using the domain of the issuer URI registered for the externasl OIDC provider in Entra.

Similat to the instructions documented here: https://learn.microsoft.com/en-us/entra/external-id/customers/concept-authentication-methods-customers#issuer-acceleration

Custom OIDC: domain_hint=<issuer URI>. For a custom OIDC identity provider, use the domain part of the Issuer URI in the domain_hint syntax such as "www.linkedin.com" for LinkedIn.

Josh Dinndorf 176 Reputation points

2026-06-22T19:07:37.7866667+00:00

thank you!!

We went a different direction here but I assume this will work and accepted as answer.

2 additional answers

Your answer

Martin Kallukalam 555 Reputation points

2025-09-08T02:25:47.2066667+00:00

same problem here. domain hint works with SAML but not with OIDC
Josh Dinndorf 176 Reputation points

2025-09-08T15:34:50+00:00

MS Support got back to me and mentioned this is not supported. No comment on if it will ever be supported and/or when....

We are flipping to another 3rd party solution here as Entra External ID is not ready to replace Azure B2C and MS is not able to address these missing features.

"Upon receiving your request, I've had an internal discussion with my team and also created an internal ticket to consult with our higher engineers.

Unfortunately, at the moment, External ID doesn't support domain hint parameter yet. "
Josh Dinndorf 176 Reputation points

2026-06-22T19:07:37.7866667+00:00

thank you!!

We went a different direction here but I assume this will work and accepted as answer.

Answer 1

Josh Dinndorf 176

MS Support got back to me and mentioned this is not supported. No comment on if it will ever be supported and/or when....

We are flipping to another 3rd party solution here as Entra External ID is not ready to replace Azure B2C and MS is not able to address these missing features.

"Upon receiving your request, I've had an internal discussion with my team and also created an internal ticket to consult with our higher engineers.

Unfortunately, at the moment, External ID doesn't support domain hint parameter yet. "

Martin Kallukalam 555 Reputation points

2025-09-08T16:04:10.55+00:00

Thanks for sharing this.
I spent several hrs trying to find why it wouldnt work . thank you!
Ellis Smith 5 Reputation points

2025-09-11T13:01:28.7266667+00:00

Thanks Josh for relaying that info back here, very helpful.

Answer 2

Benjamin Versteeg 5

I personally also didn't get it to work with domain_hint, however, I did manage to get it to work by passing idp parameter instead of domain_hint. Unfortunately, this method does require prior knowledge of the Identity Provider ID which in my case, the only way I could figure it out was by first logging in with a user of that Identity provider. Once the user was created within my Entra ID External ID environment, I was able to get the ID of the Identity Provider.

I was able to recover the ID of the identity provider by clicking on the user in the users directory and then click on the link called Identities. Here you will find the Issued assigned ID. This ID can then be used to redirect the user directly to the correct login screen without needing to first make a selection. Just pass the ID as &idp=<ID>.Passing the name as idp instead of an ID did not work. And perhaps we can grab the ID from the identity provider using the graph API. I have not tried this yet.

Please let me know if you guys found a better way of getting the Identity Provider ID without needing to first login with a user using that identity provider.

Josh Dinndorf 176 Reputation points

2025-09-16T20:31:01.5966667+00:00

Thanks for this, I saw some references to &idp=<ID> but wasn't able to get that to work.

We ended up migrating off Azure B2C / Entra External ID and going with a different 3rd party solution.
Benjamin Versteeg 5 Reputation points

2025-09-17T12:25:19.81+00:00

I would like to actually further clarify that my solution that I thought was a solution was in fact not a solution. When passing idp=<id>, this only seems to be working when you have a session active already where you have logged in. In an incognito browser tab I am not automatically redirected. Just to clarify for those that try my solution.
Ellis Smith 5 Reputation points

2025-09-17T12:30:55.7533333+00:00

@Benjamin Versteeg Yes that is what I had - also tried swapping to SAML as the domain_hint is possible with that, but then there is a "Do you trust xyz.onmicrosoft.com", which interrupts a seamless flow for a user.

We've decided to use a 3rd party OSS solution instead.
Martin Kallukalam 555 Reputation points

2025-09-17T15:34:27.97+00:00

@Ellis Smith
This is by design. a security feature introduced in 2023 , basically warning the user that they are now going to access a resource in a different domain different from their home idp.
official doc below. It only happens once until you clear the cache and cookie.

https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/home-realm-discovery-policy
Eddie Liao 0 Reputation points

2026-04-09T00:42:29.85+00:00

As of today's test; loginhint with a user's email that is on CIAM, would transition that user directly to the IdP which tested working with Google; but after login, CIAM would complain missing context and refuse to issue token on entra, so something isn't right during the transition. Might open a bug with MS about this.