Microsoft Security | Microsoft Entra | Microsoft Entra External ID
Managing external identities to enable secure access for partners, customers, and other non-employees
Queries and documentation or guidance in Entra External ID tenant with workforce tenant
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(153.6, 36%, 24%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EAD%3C/text%3E%3C/svg%3E)
Atmaram Dutta
40
Reputation points
Hi Team,
We are new to Entra external ID tenant and encountered came across below scenarios. Any help is greatly appreciated.
- There is one internal workforce tenant and External ID tenant(Managed by same organization). What would be the best possible way to have mechanism in workforce tenant by which any user from external tenant could be authorized. There would be a need to have handshake/sync by which any application in workforce tenant can Authorize user/ user claims from Entra external ID.
- In Entra external ID tenant, there would be users from different client organization. Each client company will have a predefined phrase (custom challenge) which will be used during login along with email and one time passcode(Send over the email). The predefined phrase will be different for each client but should remain the same for all users of a client organization. This phrase will be already informed to each client. As natively user flow does not support custom challenge, what is the ideal approach to have this implemented in external tenant.
- How to programmatically onboard users in Entra external ID tenant. This should not be self-signup flow as we are not giving direct permission to end customer user to self-register. What would be ideal approach to handle this from Azure function which is in workforce tenant.
Thank you.
Microsoft Security | Microsoft Entra | Microsoft Entra External ID
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(153.6, 7.000000000000001%, 24%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EC%3C/text%3E%3C/svg%3E)
Carolyne 1,151 Reputation points Microsoft Employee2026-03-19T07:59:17.4466667+00:00 Hello Atmaram!
I am curious of how you went about this. Here are my thoughts.
Authorize External ID users to workforce apps: Use B2B collaboration / cross‑tenant access so apps in the workforce tenant trust users from the External ID tenant via standard OIDC/OAuth federation and claims, with authorization enforced through app roles or groups in the workforce tenant.Custom “predefined phrase” during sign‑in: Native External ID user flows don’t support shared custom challenges; the recommended approach is Custom Authentication Extensions (or a custom front‑end before redirect) where the phrase is validated against a per‑client attribute or external store during authentication.
Programmatic user onboarding (no self‑signup): Use Microsoft Graph APIs to create and manage users programmatically in the External ID tenant, triggered from an Azure Function in the workforce tenant, keeping full control over onboarding and lifecycle without exposing self‑registration.
Sign in to comment
Sign in to answer