Enable URL-Based Routing to Specific Federated IdPs in Microsoft Entra External ID

We are building a multi-tenant SaaS application using Microsoft Entra External ID in a broker model. Each customer has their own external tenant and federated identity provider (OIDC). Our goal is to allow users to sign in using their existing credentials from their customer’s IdP, even if they share the same email address across multiple tenants.

Currently, Entra External ID lacks the ability to:

• Route users directly to a specific federated IdP based on the login URL or query parameter (e.g., idp or domain_hint).
• Create customer-specific user flows that immediately redirect to a federated IdP without showing a list of all configured IdPs.
• Support automatic redirection similar to ADFS’s whr parameter.

This limitation prevents us from achieving true customer isolation and seamless user experience in our SaaS platform. We request:

• Support for query parameters like idp in External ID login URLs.
• Ability to configure user flows that auto-redirect to a specific IdP.
• Support for custom routing logic based on URL, domain, or tenant context.
• Ability to use a single broker for app registrations and token enrichment for our web application.

This feature is critical for enabling scalable, secure, and user-friendly multi-tenant SaaS architectures. We are building a multi-tenant SaaS application using Microsoft Entra External ID in a broker model. Each customer has their own External ID tenant and federated identity provider (OIDC). Our goal is to allow users to sign in using their existing credentials from their customer’s IdP, even if they share the same email address across multiple tenants.

Currently, Entra External ID lacks the ability to:

• Route users directly to a specific federated IdP based on the login URL or query parameter (e.g., idp or domain_hint).
• Create customer-specific user flows that immediately redirect to a federated IdP without showing a list of all configured IdPs.
• Support automatic redirection similar to ADFS’s whr parameter.