EntraID external tenant - OIDC federation with another idp - domain_hint not honored

Question

EntraID external tenant - OIDC federation with another idp - domain_hint not honored

Martin Kallukalam 555

Scenario
Az Entra ID external tenant

Federation with another idp (Auth0) with OIDC .
I am able to sign in using a user on idp to an app registration (SPN).
During sign up it presents the MS login screen where you enter email and it does home realm discovery and directs to the Idp. So far working great.
However if I do a domain_hint it doesnt bypass the Home realm discovery and direct straight to Idp.
If I am using SAML as protocol to federate with Idp , domain_hint works perfect.

Raymond de Jong 91 Reputation points

2026-08-31T11:58:38.4233333+00:00

Seems this question is nearly 1 year old and was not supported at that time, but reading documentation it should be supported? I followed the documentation https://github.com/MicrosoftDocs/entra-docs/blob/main/docs/external-id/customers/how-to-entra-id-federation-customers.md but using domain_hint it does not show the tenant. Double and Tripple checked.. Claude checked it as well several times
RoryB 705 Reputation points

2026-08-31T22:36:55.7633333+00:00

I have it working. I used Kinde, and my "Issuer URI" is https://mykinde.kinde.com, and my domain hint is mykinde.kinde.com.
Martin Kallukalam 555 Reputation points

2026-08-31T23:52:09.49+00:00

@RoryB were you able to get the OIDC working without creating a sign in user flow ?
Martin Kallukalam 555 Reputation points

2026-08-31T23:52:40.0233333+00:00

@RoryB were you able to get the OIDC working without creating a sign in user flow ?
RoryB 705 Reputation points

2026-09-01T04:09:40.23+00:00

@Martin Kallukalam No - didn't try that - I always create an app registration and a user flow
Martin Kallukalam 555 Reputation points

2026-09-01T12:42:44.81+00:00

@RoryB
OIDC domain hit have always worked when using sign-in user flow.
Where it was not working was when there was no signin flow attached to app registration, then passing domain hint wouldnt take you to idp login page

2 answers

Your answer

Raymond de Jong 91 Reputation points

2026-08-31T11:58:38.4233333+00:00

Seems this question is nearly 1 year old and was not supported at that time, but reading documentation it should be supported? I followed the documentation https://github.com/MicrosoftDocs/entra-docs/blob/main/docs/external-id/customers/how-to-entra-id-federation-customers.md but using domain_hint it does not show the tenant. Double and Tripple checked.. Claude checked it as well several times
RoryB 705 Reputation points

2026-08-31T22:36:55.7633333+00:00

I have it working. I used Kinde, and my "Issuer URI" is https://mykinde.kinde.com, and my domain hint is mykinde.kinde.com.
Martin Kallukalam 555 Reputation points

2026-08-31T23:52:09.49+00:00

@RoryB were you able to get the OIDC working without creating a sign in user flow ?
Martin Kallukalam 555 Reputation points

2026-08-31T23:52:40.0233333+00:00

@RoryB were you able to get the OIDC working without creating a sign in user flow ?
RoryB 705 Reputation points

2026-09-01T04:09:40.23+00:00

@Martin Kallukalam No - didn't try that - I always create an app registration and a user flow
Martin Kallukalam 555 Reputation points

2026-09-01T12:42:44.81+00:00

@RoryB
OIDC domain hit have always worked when using sign-in user flow.
Where it was not working was when there was no signin flow attached to app registration, then passing domain hint wouldnt take you to idp login page

Answer 1

Parthasarathy K 0

Hello Praveen,

regards to this issue, we have created a separate tenant/directory for federating with external IdP. We thought if we remove "Email with Password" and "Email one-time passcode" and then add the external idp it would redirect. But i am able to remove the Email one-time passcode from the userflow but not "Email with Password".Can you help us to remove "Email with Password" from our tenant if its possible? Also kindly let us know what's the solution for this issue as we are not able to redirect to the external idp.

Anonymous

2025-11-10T09:42:57.12+00:00
Hi Parthasarathy,

Thank you for posting your query on Microsoft Q&A.

You are integrating an EntraID external tenant with another IdP (Auth0) using OIDC federation, and while the domain_hint parameter works as expected with SAML (bypassing Home Realm Discovery and redirecting immediately to the IdP), it is not honored with OIDC, resulting in the Microsoft login screen and manual realm selection.

The domain_hint parameter provides home realm hints to streamline sign-ins, but with OIDC federation in Entra External ID, the hint may not always bypass the Microsoft login screen if the domain or IdP is not registered as a verified federated domain in Entra.

As of recent updates, OIDC federation in Entra External ID primarily supports external non-Entra tenants (third-party OIDC IdPs, Azure AD B2C, personal Microsoft account, etc.), and direct federation with other Entra tenants has restrictions and does not fully support automatic acceleration using domain_hint the way SAML does.petri+2

The Home Realm Discovery (HRD) policy can override domain_hint behavior, and unless the configured domain is federated and set up properly in Entra, the hint may be ignored or prompt manual discovery.

Actionable Steps:

1. Confirm OIDC IdP (Auth0) registration in Entra external tenant.

Make sure your IdP setup follows Microsoft’s OIDC guide for external identities.

2. Check the Federation Domain status.

Only domains configured as verified federated domains will respect domain_hint. You can confirm this in the Entra admin center.

3. Review and Adjust Home Realm Discovery policies.

If you want to control whether the domain_hint is respected or ignored for your apps, you can update HRD policies using the [HRD policy PowerShell module].

For fine-tuning, use:

RespectDomainHintForDomains: to ensure domain_hint is honored for your federated IdP.

IgnoreDomainHintForDomains or IgnoreDomainHintForApps: to prevent honoring domain_hint for specified cases.

4. Monitor product roadmap.

Microsoft is developing upgrades for OIDC federation, including expanded support for domain-based hints and automatic acceleration—as mentioned in recent community updates, these are not yet GA (general availability).

References

OpenID Connect on Microsoft identity platform learn.microsoft

OIDC external identity provider configuration guide learn.microsoft

Answer 2

Anonymous

Hi Martin Kallukalam,

Thank you for posting your query on Microsoft Q&A.

In Microsoft Entra ID, when federating with an external IdP using OpenID Connect (OIDC), the domain_hint parameter is intended to help direct users efficiently to their federated sign-in page. However, as of now, when used in external tenant OIDC federation flows, the domain_hint parameter does not bypass the Home Realm Discovery (HRD) screen and will not automatically redirect users to the IdP. This differs from SAML federation, where domain_hint works as expected and enables direct redirection to the external IdP’s sign-in page.

This limitation is documented in Microsoft’s current preview support for custom IdPs over OIDC in Entra External ID. It is a known product behavior, and Microsoft is working to improve this experience in future releases.

Home Realm Discovery (HRD) policies and auto-acceleration settings may influence redirection behavior, but with OIDC, domain_hint currently cannot force direct IdP routing in external tenant scenarios.
SAML federation continues to support seamless domain_hint-based routing to IdPs.

Please refer to: Home Realm Discovery policy for an application

Please "Accept as Answer" if the answer provided is useful, so that you can help others in the community looking for remediation for similar issues.

Martin Kallukalam 555 Reputation points

2025-09-22T13:05:57.0366667+00:00

@Anonymous
I read the document link you posted where you say it is documented that domain hint is not supported in OIDC federation. I couldnt find it there.
Can you paste the relevant section here pls
Anonymous

2025-09-23T11:39:18.16+00:00

Hi Martin,

We understand your question and apologize for the lack of clarity. We can confirm that the behavior you are seeing is expected and is a current limitation in the public preview of the OIDC federation feature for Microsoft Entra external tenants. The functionality you are seeking, where domain_hint bypasses the Home Realm Discovery screen to directly redirect to your IdP, is not yet supported.

Currently, this capability is only available and fully supported with SAML federation. While we understand that you are using OIDC, this is a known product behavior that our engineering teams are actively working to address.

Thank you!
Anonymous

2025-09-24T10:07:46.3366667+00:00

Hi Martin,

Following up to see if the above answer was helpful. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.
Anonymous

2025-09-25T09:17:52.0266667+00:00

Hi Martin,

Following up to see if the above answer was helpful. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.