External Identities User Flows: Metadata Endpoint Returns 404 After 24+ Hours

Question

External Identities User Flows: Metadata Endpoint Returns 404 After 24+ Hours

John Flood 0

I am configuring the Entra External Identity for an SaaS application. I have 2 tenants, the primary workspace tenant, where I setup the application, Entra and user flow. The second tenant is an external Identity and is intended to allow external users to sign-up for the application. I am receiving a 404 error. I have checked for valid subscription and configuration.

- Tenant ID: xxx
Tenant Name: nnn
Primary Domain: ddd
Metadata endpoint: https://nnn.ciamlogin.com/.well-known/openid-configuration
Timeline: 24+ hours of 404 errors
Request: Verify if External Identities is properly enabled, if ciamlogin.com domain is provisioned, and if there are any subscription/licensing restriction

Rukmini 43,915 Reputation points Microsoft External Staff Moderator

2025-12-09T17:48:35.7733333+00:00
Hello John Flood,

Your 404 error on https://.ciamlogin.com/.well-known/openid-configuration indicates that either the custom CIAM domain is not completely provisioned/verified or your external tenant is not set up as a Microsoft Entra External ID (CIAM) tenant. The OIDC metadata endpoint is only functional for CIAM tenants when:

The tenant is not a typical Entra workforce tenant, but rather an External ID (CIAM) tenant.

Instead of in your primary tenancy, a user flow (Sign-up/Sign-in) is developed inside the CIAM tenant.

If a custom URL domain was added, DNS verification is included in the fully provided ciamlogin.com domain.

In that tenant, at least one CIAM application (with a redirect URI) is built. ciamlogin.com returns 404 if any of the aforementioned are absent.

This occurs 99% of the time because either the CIAM tenant was never created or the user flow was built in the workforce tenant rather than the External ID tenant.

To fix the issue: Set up user flow in an External ID (CIAM) tenant after creating and verifying one. The metadata endpoint will function if the ciamlogin.com domain is validated.

Let me know if any further queries - feel free to reach out!
Rukmini 43,915 Reputation points Microsoft External Staff Moderator

2025-12-10T19:17:20.26+00:00

Hello John Flood, Following up to see if the above provided information was helpful. If you have any further queries do let us know.
John Flood 0 Reputation points

2025-12-11T17:56:11.4866667+00:00

I am still working on creating the CIAM tenant properly. Is it safe to share screenshots?
Rukmini 43,915 Reputation points Microsoft External Staff Moderator

2025-12-11T18:37:51.3966667+00:00

John Flood Yes, you can paste screenshots over private messages

John Flood 0

Here is my config. I created a new tenant to ensure that I did not have any mistakes in the prior instance. The app is registered in the external tenant as is the user flow. I am testing the status with the following link which should show json, but returns a 404.

   -  **Example**: `https://PII.ciamlogin.com/.well-known/openid-configuration`

{

	"auth": {
		"tenantId": "PII",
		"clientId": "PII",
		"authority": "https://PII.ciamlogin.com/PII/B2X_1_Sign-in",
		"redirectUri": "http://localhost:5173",
		"postLogoutRedirectUri": "http://localhost:5173"
	},
	"api": {
		"baseUrl": "https://Lynk-Comply.azurewebsites.net/api",
		"scopes": ["api://PII/access_as_user"]
	},
	"storage": {
		"accountName": "PII",
		"containerName": "company-files"
	},
	"signalR": {
		"connectionString": "YOUR_SIGNALR_CONNECTION_STRING",
		"hubName": "notifications"
	}
}

John Flood 0 Reputation points

2025-12-12T02:37:33.5966667+00:00
I did more research and it appears that I was using the wrong validation url. I used PII and received the following response:. Can you confirm it is properly setup now?

PII
Rukmini 43,915 Reputation points Microsoft External Staff Moderator

2025-12-12T16:44:18.1966667+00:00

Hello John Flood,

Yes, your CIAM setup is now correct.

Let me know if any further queries - feel free to reach out!
John Flood 0 Reputation points

2025-12-13T20:44:08.23+00:00
I am still not able to properly implement a simple login.

Problem: Authorization endpoint for Microsoft Entra External ID user flow returns "The resource you are looking for has been removed, had its name changed, or is temporarily unavailable" error (404/resource not found).

Impact: Cannot authenticate users through the configured user flow. Application cannot proceed with CIAM implementation.

Environment: Production CIAM tenant attempting to implement external user authentication

Tenant & Application Details

CIAM Tenant Information

Tenant Name: GovLynk

Tenant ID: PII

Domain: PII

CIAM Domain: PII

Tenant Type: Microsoft Entra External ID (CIAM) - CONFIRMED

Application Registration

Application Name: Lynk-Comply

Client ID: PII

Application Type: Single-page application (SPA)

Redirect URI: http://localhost:5173 (configured under SPA platform)

Platform Configuration: Single-page application (NOT Web)

Implicit Grant Settings:

✅ Access tokens enabled

✅ ID tokens enabled

User Flow Configuration

User Flow Name: B2X_1_Sign-in (EXACT case - case-sensitive)

User Flow Type: Sign up and sign in (Recommended)

Identity Providers Configured:

Azure Active Directory Sign up (enabled)

Microsoft Account (enabled)

Email one-time passcode (enabled)

User Attributes: Email Address, City, Display Name

Application Association: Lynk-Comply app IS associated with user flow (CONFIRMED)

What Works

✅ Metadata Endpoint: Successfully returns JSON configuration

https://PII.ciamlogin.com/lynkexternal.onmicrosoft.com/v2.0/.well-known/openid-configuration

Returns valid OpenID configuration including:

authorization_endpoint

token_endpoint

jwks_uri

All expected claims and scopes

✅ Tenant Configuration: CIAM tenant properly configured ✅ App Registration: Properly configured in CIAM tenant ✅ User Flow Creation: User flow exists and is visible in portal ✅ App Association: Application successfully associated with user flow ✅ Identity Providers: Multiple providers configured and enabled ✅ Redirect URI: Properly configured as SPA platform type

What Fails

❌ Authorization Endpoint: ALL attempts to access authorization endpoint fail with "resource unavailable" error

Failed URL Formats Tested

Format 1: Tenant ID with query parameter

https://PII.ciamlogin.com/PII/oauth2/v2.0/authorize?p=B2X_1_Sign-in&client_id=PII&redirect_uri=http://localhost:5173&response_type=code&scope=openid&response_mode=query

Result: 404 / Resource unavailable

Format 2: Tenant domain with query parameter

https://PII.ciamlogin.com/lynkexternal.onmicrosoft.com/oauth2/v2.0/authorize?p=B2X_1_Sign-in&client_id=PII&redirect_uri=http://localhost:5173&response_type=code&scope=openid&response_mode=query

Result: 404 / Resource unavailable

Format 3: User flow in path

https://PII.ciamlogin.com/PII.onmicrosoft.com/B2X_1_Sign-in/oauth2/v2.0/authorize?client_id=PII3&redirect_uri=http://localhost:5173&response_type=code&scope=openid&response_mode=query

Result: 404 / Resource unavailable

Format 4: Implicit flow (id_token)

https://PII.ciamlogin.com/PII.onmicrosoft.com/oauth2/v2.0/authorize?p=B2X_1_Sign-in&client_id=PII&redirect_uri=http://localhost:5173&response_type=id_token&scope=openid&response_mode=fragment&nonce=test123

Result: 404 / Resource unavailable

Troubleshooting Steps Completed

Configuration Verification

✅ Verified CIAM tenant type (confirmed External ID tenant)

✅ Verified user flow name case sensitivity (B2X_1_Sign-in exact case)

✅ Verified app registration is in CIAM tenant (not workforce tenant)

✅ Verified platform type is Single-page application (not Web)

✅ Verified redirect URI exact match (http://localhost:5173 - no trailing slash)

✅ Verified identity providers are enabled and configured

✅ Verified app is associated with user flow

✅ Verified implicit grant settings are enabled

✅ Verified supported account types (multitenant)

✅ Verified user attributes and application claims are configured

Testing Performed

✅ Tested metadata endpoint (works)

✅ Tested multiple authorization URL formats (all fail)

✅ Tested different response types (code, id_token, hybrid - all fail)

✅ Tested both tenant ID and tenant domain formats (both fail)

✅ Tested with user flow in path vs query parameter (both fail)

✅ Tested in multiple browsers and incognito mode

✅ Cleared browser cache multiple times

✅ Waited 24+ hours for Azure propagation

Portal Observations

❌ "Run user flow" button not visible in user flow interface (may be expected for External ID)

✅ User flow appears properly configured with all required settings

✅ No visible warnings or errors in user flow configuration

✅ All sections (Identity providers, User attributes, Applications) properly configured

Sign-in Logs Analysis

✅ Checked sign-in logs in Microsoft Entra admin center

❌ NO sign-in attempts logged for Lynk-Comply application

✅ Sign-in logs show successful Azure Portal sign-ins only

Observation: Authorization endpoint fails BEFORE Azure even logs the attemptProblem: Authorization endpoint for Microsoft Entra External ID user flow returns "The resource you are looking for has been removed, had its name changed, or is temporarily unavailable" error (404/resource not found). Impact: Cannot authenticate users through the configured user flow. Application cannot proceed with CIAM implementation. Environment: Production CIAM tenant attempting to implement external user authentication
Tenant & Application Details

CIAM Tenant Information

Tenant Name: GovLynk

Tenant ID: PII

Domain: PII.onmicrosoft.com

CIAM Domain: PII.ciamlogin.com

Tenant Type: Microsoft Entra External ID (CIAM) - CONFIRMED
Application Registration

Application Name: Lynk-Comply

Client ID: PII

Application Type: Single-page application (SPA)

Redirect URI: http://localhost:5173 (configured under SPA platform)

Platform Configuration: Single-page application (NOT Web)

Implicit Grant Settings:
- ✅ Access tokens enabled - ✅ ID tokens enabled

User Flow Configuration

User Flow Name: B2X_1_Sign-in (EXACT case - case-sensitive)

User Flow Type: Sign up and sign in (Recommended)

Identity Providers Configured:
- Azure Active Directory Sign up (enabled) - Microsoft Account (enabled) - Email one-time passcode (enabled) - **User Attributes:** Email Address, City, Display Name - **Application Association:** Lynk-Comply app IS associated with user flow (CONFIRMED)

What Works
✅ Metadata Endpoint: Successfully returns JSON configuration

https://PII.ciamlogin.com/PII.onmicrosoft.com/v2.0/.well-known/openid-configuration
Returns valid OpenID configuration including:
- authorization_endpoint - token_endpoint - jwks_uri - All expected claims and scopes
✅ Tenant Configuration: CIAM tenant properly configured ✅ App Registration: Properly configured in CIAM tenant ✅ User Flow Creation: User flow exists and is visible in portal ✅ App Association: Application successfully associated with user flow ✅ Identity Providers: Multiple providers configured and enabled ✅ Redirect URI: Properly configured as SPA platform type
What Fails
❌ Authorization Endpoint: ALL attempts to access authorization endpoint fail with "resource unavailable" error
Failed URL Formats Tested
Format 1: Tenant ID with query parameter
https://PII.ciamlogin.com/PII/oauth2/v2.0/authorize?p=B2X_1_Sign-in&client_id=PII&redirect_uri=http://localhost:5173&response_type=code&scope=openid&response_mode=query
Result: 404 / Resource unavailable Format 2: Tenant domain with query parameter
https://PII.ciamlogin.com/PII.onmicrosoft.com/oauth2/v2.0/authorize?p=B2X_1_Sign-in&client_id=PII&redirect_uri=http://localhost:5173&response_type=code&scope=openid&response_mode=query
Result: 404 / Resource unavailable Format 3: User flow in path
https://PII.ciamlogin.com/lynkexternal.onmicrosoft.com/B2X_1_Sign-in/oauth2/v2.0/authorize?client_id=PII&redirect_uri=http://localhost:5173&response_type=code&scope=openid&response_mode=query
Result: 404 / Resource unavailable Format 4: Implicit flow (id_token)
https://PII.ciamlogin.com/lynkexternalPII.onmicrosoft.com/oauth2/v2.0/authorize?p=B2X_1_Sign-in&client_id=PII&redirect_uri=http://localhost:5173&response_type=id_token&scope=openid&response_mode=fragment&nonce=test123
Result: 404 / Resource unavailable
Troubleshooting Steps Completed

Configuration Verification

1. ✅ Verified CIAM tenant type (confirmed External ID tenant) 1. ✅ Verified user flow name case sensitivity (`B2X_1_Sign-in` exact case) 1. ✅ Verified app registration is in CIAM tenant (not workforce tenant) 1. ✅ Verified platform type is Single-page application (not Web) 1. ✅ Verified redirect URI exact match (`http://localhost:5173` - no trailing slash) 1. ✅ Verified identity providers are enabled and configured 1. ✅ Verified app is associated with user flow 1. ✅ Verified implicit grant settings are enabled 1. ✅ Verified supported account types (multitenant) 1. ✅ Verified user attributes and application claims are configured

Testing Performed

1. ✅ Tested metadata endpoint (works) 1. ✅ Tested multiple authorization URL formats (all fail) 1. ✅ Tested different response types (code, id_token, hybrid - all fail) 1. ✅ Tested both tenant ID and tenant domain formats (both fail) 1. ✅ Tested with user flow in path vs query parameter (both fail) 1. ✅ Tested in multiple browsers and incognito mode 1. ✅ Cleared browser cache multiple times 1. ✅ Waited 24+ hours for Azure propagation

Portal Observations

1. ❌ **"Run user flow" button not visible** in user flow interface (may be expected for External ID) 1. ✅ User flow appears properly configured with all required settings 1. ✅ No visible warnings or errors in user flow configuration 1. ✅ All sections (Identity providers, User attributes, Applications) properly configured

Sign-in Logs Analysis

✅ Checked sign-in logs in Microsoft Entra admin center

❌ NO sign-in attempts logged for Lynk-Comply application

✅ Sign-in logs show successful Azure Portal sign-ins only

Observation: Authorization endpoint fails BEFORE Azure even logs the attempt
Rukmini 43,915 Reputation points Microsoft External Staff Moderator

2025-12-15T17:11:24.14+00:00

Hello John Flood, Your CIAM setup is correct. The authorization URL is wrong and hence the 404

For Microsoft Entra External ID (CIAM) use the below authorization endpoint:

https://lynkexternal.ciamlogin.com/TenantID/oauth2/v2.0/authorize

?p=B2X_1_Sign-in

&client_id=ClientID

&response_type=code

&redirect_uri=http://localhost:5173

&scope=openid

&response_mode=query

&code_challenge=XXX

&code_challenge_method=S256

And the token URL must be https://rukext.ciamlogin.com/TenantID/oauth2/v2.0/token

Let me know if any further queries!
Rukmini 43,915 Reputation points Microsoft External Staff Moderator

2025-12-16T18:22:20.3+00:00

Hello John Flood,

Following up to see if the above provided information was helpful. If you have any further queries do let us know.
Rukmini 43,915 Reputation points Microsoft External Staff Moderator

2025-12-17T23:22:41.2633333+00:00

Hello John Flood,

Could you please provide email address and availability time and time zone so that we can connect offline over private message?
Rukmini 43,915 Reputation points Microsoft External Staff Moderator

2025-12-23T19:44:24.8333333+00:00

Hello John Flood,

Could you please provide email address and availability time and time zone so that we can connect offline over private message?
John Flood 0 Reputation points

2025-12-30T20:12:31.58+00:00

How do I connect by private message?
Rukmini 43,915 Reputation points Microsoft External Staff Moderator

2026-01-02T12:43:34.5933333+00:00

Hello John Flood,

Please check the private messages
John Flood 0 Reputation points

2026-01-11T02:45:33.78+00:00

i continue to have issues viewing private messages. I click the link in the email, but it still only shows this thred.

Your answer

Rukmini 43,915 Reputation points Microsoft External Staff Moderator

2025-12-09T17:48:35.7733333+00:00

Hello John Flood,

Your 404 error on https://.ciamlogin.com/.well-known/openid-configuration indicates that either the custom CIAM domain is not completely provisioned/verified or your external tenant is not set up as a Microsoft Entra External ID (CIAM) tenant. The OIDC metadata endpoint is only functional for CIAM tenants when:

The tenant is not a typical Entra workforce tenant, but rather an External ID (CIAM) tenant.

Instead of in your primary tenancy, a user flow (Sign-up/Sign-in) is developed inside the CIAM tenant.

If a custom URL domain was added, DNS verification is included in the fully provided ciamlogin.com domain.

In that tenant, at least one CIAM application (with a redirect URI) is built. ciamlogin.com returns 404 if any of the aforementioned are absent.

This occurs 99% of the time because either the CIAM tenant was never created or the user flow was built in the workforce tenant rather than the External ID tenant.

To fix the issue: Set up user flow in an External ID (CIAM) tenant after creating and verifying one. The metadata endpoint will function if the ciamlogin.com domain is validated.

Let me know if any further queries - feel free to reach out!
Rukmini 43,915 Reputation points Microsoft External Staff Moderator

2025-12-10T19:17:20.26+00:00

Hello John Flood, Following up to see if the above provided information was helpful. If you have any further queries do let us know.
John Flood 0 Reputation points

2025-12-11T17:56:11.4866667+00:00

I am still working on creating the CIAM tenant properly. Is it safe to share screenshots?
Rukmini 43,915 Reputation points Microsoft External Staff Moderator

2025-12-11T18:37:51.3966667+00:00

John Flood Yes, you can paste screenshots over private messages
John Flood 0 Reputation points

2025-12-12T01:39:23.5966667+00:00

Here is my config. I created a new tenant to ensure that I did not have any mistakes in the prior instance. The app is registered in the external tenant as is the user flow. I am testing the status with the following link which should show json, but returns a 404.

- **Example**: `https://PII.ciamlogin.com/.well-known/openid-configuration`

{

"auth": { "tenantId": "PII", "clientId": "PII", "authority": "https://PII.ciamlogin.com/PII/B2X_1_Sign-in", "redirectUri": "http://localhost:5173", "postLogoutRedirectUri": "http://localhost:5173" }, "api": { "baseUrl": "https://Lynk-Comply.azurewebsites.net/api", "scopes": ["api://PII/access_as_user"] }, "storage": { "accountName": "PII", "containerName": "company-files" }, "signalR": { "connectionString": "YOUR_SIGNALR_CONNECTION_STRING", "hubName": "notifications" } }
John Flood 0 Reputation points

2025-12-12T02:37:33.5966667+00:00

I did more research and it appears that I was using the wrong validation url. I used PII and received the following response:. Can you confirm it is properly setup now?

PII
Rukmini 43,915 Reputation points Microsoft External Staff Moderator

2025-12-12T16:44:18.1966667+00:00

Hello John Flood,

Yes, your CIAM setup is now correct.

Let me know if any further queries - feel free to reach out!
Rukmini 43,915 Reputation points Microsoft External Staff Moderator

2025-12-15T17:11:24.14+00:00

Hello John Flood, Your CIAM setup is correct. The authorization URL is wrong and hence the 404

For Microsoft Entra External ID (CIAM) use the below authorization endpoint:

https://lynkexternal.ciamlogin.com/TenantID/oauth2/v2.0/authorize

?p=B2X_1_Sign-in

&client_id=ClientID

&response_type=code

&redirect_uri=http://localhost:5173

&scope=openid

&response_mode=query

&code_challenge=XXX

&code_challenge_method=S256

And the token URL must be https://rukext.ciamlogin.com/TenantID/oauth2/v2.0/token

Let me know if any further queries!
Rukmini 43,915 Reputation points Microsoft External Staff Moderator

2025-12-16T18:22:20.3+00:00

Hello John Flood,

Following up to see if the above provided information was helpful. If you have any further queries do let us know.
Rukmini 43,915 Reputation points Microsoft External Staff Moderator

2025-12-17T23:22:41.2633333+00:00

Hello John Flood,

Could you please provide email address and availability time and time zone so that we can connect offline over private message?
Rukmini 43,915 Reputation points Microsoft External Staff Moderator

2025-12-23T19:44:24.8333333+00:00

Hello John Flood,

Could you please provide email address and availability time and time zone so that we can connect offline over private message?
John Flood 0 Reputation points

2025-12-30T20:12:31.58+00:00

How do I connect by private message?
Rukmini 43,915 Reputation points Microsoft External Staff Moderator

2026-01-02T12:43:34.5933333+00:00

Hello John Flood,

Please check the private messages
John Flood 0 Reputation points

2026-01-11T02:45:33.78+00:00

i continue to have issues viewing private messages. I click the link in the email, but it still only shows this thred.

External Identities User Flows: Metadata Endpoint Returns 404 After 24+ Hours

Tenant & Application Details

CIAM Tenant Information

Application Registration

User Flow Configuration

What Works

What Fails

Failed URL Formats Tested

Troubleshooting Steps Completed

Configuration Verification

Testing Performed

Portal Observations

Sign-in Logs Analysis

Tenant & Application Details

CIAM Tenant Information

Application Registration

User Flow Configuration

What Works

What Fails

Failed URL Formats Tested

Troubleshooting Steps Completed

Configuration Verification

Testing Performed

Portal Observations

Sign-in Logs Analysis

Your answer