Microsoft Entra External ID Support federation with other Microsoft Tenants

Question

Microsoft Entra External ID Support federation with other Microsoft Tenants

Stephan Nader 5

We are currently planning on using Microsoft External ID for a learning platform and it would be vital for us, to enable schools using Entra ID / Azure AD to do SSO on our platform. We will only launch in a Q2.2026, but we will need to know very soon now, if External ID has this capability within the next 6 months or not. I know this question has been asked before here, I also talked to Microsoft representatives, but no ones seems to have an answer. Can you please give us (any many other customers with the same requirements), and indication of whether a) this is still on the roadmap as a priority, and b) whether we can expect this short term, mid term or never ever (keeping the timing intentionally vague...).

Your help and clarity would be very much appreciated. Otherwise we will need to probably look for other solutions for this, but it would be a pitty, because of the rest of External ID would be a great fit.

stefan.

VEMULA SRISAI 13,990 Reputation points Microsoft External Staff Moderator

2025-10-19T06:21:36.66+00:00

Thank you for reaching out to the Microsoft Q&A forum!

Currently, Microsoft Entra External ID does not support federation with other Microsoft Entra (Azure AD) tenants. This means your learning platform cannot allow schools to directly sign in with their Entra ID accounts through External ID at this time.

As of now, Microsoft has not announced any roadmap or timeline for enabling Entra-to-Entra federation within External ID. Based on current documentation and public updates, this feature is unlikely to be available within the next 6 months or by your planned Q2 2026 launch.

However, there is a supported and production-ready alternative use a Workforce tenant instead of an External ID tenant. Workforce tenants are designed for B2B collaboration scenarios and already support cross-tenant access and SSO between Entra tenants.

Recommended Approach:

Configure your Workforce tenant to trust users from the schools’ Entra tenants.

Schools’ users can then sign in using their existing Entra ID credentials.

Manage permissions securely through cross-tenant access policies.

If you need consumer login or public registration features, you can also use a hybrid model Workforce for schools and External ID for other users though it introduces more complexity.

For your reference:

https://learn.microsoft.com/en-us/entra/external-id/cross-tenant-access-overview

https://learn.microsoft.com/en-us/entra/external-id/customers/concept-supported-features-customers

Please let me know if you need any additional Information or further assistance:
Stephan Nader 5 Reputation points

2025-10-21T06:39:55.67+00:00

Thank you for your answer Vemula Srisai. But if I understand your proposed solution correctly, then this would mean, that we would need to configure a trust-relationship between each schools tenant manually. Is this correct? This unfortunately would not be feasible, as we have hundreds of schools and want to enable a self-service SSO for the teachers and students.
VEMULA SRISAI 13,990 Reputation points Microsoft External Staff Moderator

2025-10-28T20:54:28.2233333+00:00

Stephan Nader Thank you, Stephan, for clarifying. Yes, currently each school’s tenant would need a manual trust setup in the Workforce model. Unfortunately, Entra-to-Entra federation in External ID is not yet supported or on a confirmed roadmap. For now, you can explore a custom multi-tenant app registration approach for self-service SSO. Your feedback has been shared with the product team, and we’ll update once roadmap details are available.

Your answer

VEMULA SRISAI 13,990 Reputation points Microsoft External Staff Moderator

2025-10-19T06:21:36.66+00:00

Thank you for reaching out to the Microsoft Q&A forum!

Currently, Microsoft Entra External ID does not support federation with other Microsoft Entra (Azure AD) tenants. This means your learning platform cannot allow schools to directly sign in with their Entra ID accounts through External ID at this time.

As of now, Microsoft has not announced any roadmap or timeline for enabling Entra-to-Entra federation within External ID. Based on current documentation and public updates, this feature is unlikely to be available within the next 6 months or by your planned Q2 2026 launch.

However, there is a supported and production-ready alternative use a Workforce tenant instead of an External ID tenant. Workforce tenants are designed for B2B collaboration scenarios and already support cross-tenant access and SSO between Entra tenants.

Recommended Approach:

Configure your Workforce tenant to trust users from the schools’ Entra tenants.

Schools’ users can then sign in using their existing Entra ID credentials.

Manage permissions securely through cross-tenant access policies.

If you need consumer login or public registration features, you can also use a hybrid model Workforce for schools and External ID for other users though it introduces more complexity.

For your reference:

https://learn.microsoft.com/en-us/entra/external-id/cross-tenant-access-overview

https://learn.microsoft.com/en-us/entra/external-id/customers/concept-supported-features-customers

Please let me know if you need any additional Information or further assistance:
Stephan Nader 5 Reputation points

2025-10-21T06:39:55.67+00:00

Thank you for your answer Vemula Srisai. But if I understand your proposed solution correctly, then this would mean, that we would need to configure a trust-relationship between each schools tenant manually. Is this correct? This unfortunately would not be feasible, as we have hundreds of schools and want to enable a self-service SSO for the teachers and students.
VEMULA SRISAI 13,990 Reputation points Microsoft External Staff Moderator

2025-10-28T20:54:28.2233333+00:00

Stephan Nader Thank you, Stephan, for clarifying. Yes, currently each school’s tenant would need a manual trust setup in the Workforce model. Unfortunately, Entra-to-Entra federation in External ID is not yet supported or on a confirmed roadmap. For now, you can explore a custom multi-tenant app registration approach for self-service SSO. Your feedback has been shared with the product team, and we’ll update once roadmap details are available.