b2c multi tanennant

Question

b2c multi tanennant

info csbacademy 0

Hello Microsoft Support Team,

I am requesting assistance because I am unable to configure multi-tenant Azure Active Directory (Entra ID) login in Azure AD B2C using custom policies.

Summary of the Issue

I need my Azure AD B2C tenant to allow users to sign in from:

Google (OIDC)

Microsoft personal accounts (MSA – hotmail/outlook)

Azure AD Work/School accounts from ANY tenant (multi-tenant)

Google and Microsoft personal account login work, but Azure AD multi-tenant login continues to fail.

What I’ve Tried

I have already attempted the following:

Created a multi-tenant app in Entra ID with:

Supported account types: Accounts in any organizational directory + personal Microsoft accounts

  Redirect URIs configured properly
  
     Secret created and mapped to a B2C key container
     
     Added a **Custom OIDC Provider** in B2C with:
     
        Metadata: `https://login.microsoftonline.com/organizations/v2.0/.well-known/openid-configuration`
        
           response_type = `code`
           
              response_mode = `form_post`
              
                 scope = `openid profile email`
                 
                 Added a **TechnicalProfile** in `TrustFrameworkExtensions.xml` with:
                 
                 ```yaml
                 
                 ```
                 
                 Mapped the identity provider into the **SignUpOrSignin** user journey.
                 
                 Tested through both:
                 
                    Portal → Run Policy
                    
                       Direct authorize URL with jwt.ms

Error Messages

Depending on configuration attempts, I encounter variations of:

AADB2C90238: The provided token does not contain a valid issuer

AADB2C: An exception has occurred

server_error

Token validation fails when Azure AD users authenticate

Portal Behavior

The B2C portal currently does not show “Azure Active Directory” as a built-in IdP option. Only Microsoft Account (MSA) appears. Therefore, I am using Custom OIDC instead.

What I Need

I would greatly appreciate Microsoft’s help to confirm:

Whether custom OIDC is still the officially supported method for multi-tenant Azure AD login in B2C (2025).

The exact OIDC metadata and issuer validation settings required for cross-tenant login.

Whether any recent platform or policy schema changes could affect multi-tenant OIDC integration.

Whether there are known issues with token issuer validation when using organizations authority.

Any recommended updated reference implementation for:

B2C custom policies

  Azure AD multi-tenant OIDC login
  
     Token issuer validation rules

I can provide correlation IDs, timestamps, or full custom policy XML files upon request.

Thank you very much for your assistance. I look forward to your guidance and a resolution.Hello Microsoft Support Team,

I am requesting assistance because I am unable to configure multi-tenant Azure Active Directory (Entra ID) login in Azure AD B2C using custom policies.

Summary of the Issue

I need my Azure AD B2C tenant to allow users to sign in from:

Google (OIDC)

Microsoft personal accounts (MSA – hotmail/outlook)

Azure AD Work/School accounts from ANY tenant (multi-tenant)

Google and Microsoft personal account login work, but Azure AD multi-tenant login continues to fail.

What I’ve Tried

I have already attempted the following:

Created a multi-tenant app in Entra ID with:

Supported account types: Accounts in any organizational directory + personal Microsoft accounts

  Redirect URIs configured properly
  
     Secret created and mapped to a B2C key container
     
     Added a **Custom OIDC Provider** in B2C with:
     
        Metadata: `https://login.microsoftonline.com/organizations/v2.0/.well-known/openid-configuration`
        
           response_type = `code`
           
              response_mode = `form_post`
              
                 scope = `openid profile email`
                 
                 Added a **TechnicalProfile** in `TrustFrameworkExtensions.xml` with:
                 
                 ```yaml

Sridevi Machavarapu 33,820 Reputation points Microsoft External Staff Moderator

2025-12-10T01:59:26.31+00:00
Hello info csbacademy,

Thank you for the detailed information. Multi-tenant Microsoft Entra ID sign-in is still supported in Azure AD B2C, but only through Custom Policies with OpenID Connect. The built-in “Azure Active Directory” option in the B2C portal does not support true cross-tenant scenarios, which is why you only see Microsoft Account (MSA). Using a Custom OIDC provider is the correct and supported approach.

The error:

AADB2C90238: The provided token does not contain a valid issuer

indicates that the issuer (iss) in the token does not match what B2C is configured to trust. Since you are currently using the organizations endpoint, the token issuer will be returned as:

https://login.microsoftonline.com/<tenant-id>/v2.0

If this pattern is not explicitly allowed in your issuer validation settings, token validation will fail.

To avoid this and support cross-tenant sign-in reliably, please use the common endpoint with dynamic issuer discovery in your TechnicalProfile:

<Item Key="METADATA"> https://login.microsoftonline.com/common/v2.0/.well-known/openid-configuration </Item> <Item Key="DiscoverMetadataByTokenIssuer">true</Item> <Item Key="ValidTokenIssuerPrefixes"> https://login.microsoftonline.com/ </Item>

This configuration allows users from any Entra tenant to authenticate.

Please also confirm in your app registration that:

Supported account type is Accounts in any organizational directory and personal Microsoft accounts

Redirect URI is exactly: https://<your-tenant>.b2clogin.com/<your-tenant>.onmicrosoft.com/oauth2/authresp

The same client secret is correctly stored and referenced in your B2C key container

There are no current platform changes or known service issues impacting multi-tenant Entra ID sign-in through custom OIDC when configured as above. The behavior you are seeing is consistent with an issuer validation mismatch.

If the issue continues after these changes, please test using jwt.ms and share:

The iss value from the returned ID token

The correlation ID and timestamp

Hope this helps! Feel free to reach out for any further queries.

b2c multi tanennant

Summary of the Issue

What I’ve Tried

Error Messages

Portal Behavior

What I Need

Summary of the Issue

What I’ve Tried

Your answer