Entra External ID + Google Federation: "username" parameter error on silent refresh (12-24h after login)

Hi,

We're experiencing an issue with Google federation in Entra External ID that appears to be a known problem based on other threads I've found.

The Problem:

• Initial Google sign-in works perfectly
• After 12-24 hours, when the app attempts silent token refresh, users get: "Access blocked: Authorization Error Parameter not allowed for this message type: username (Error 400: invalid_request)"
• Refreshing the page (F5) immediately works

What's Happening:

Looking at the network requests, during silent refresh Entra sends username={upn}@{tenant}.onmicrosoft.com to Google instead of login_hint={******@gmail.com}. Google rejects the username parameter.

Setup:

• Entra External ID tenant with built-in Google IDP
• Azure Static Web Apps frontend
• Users invited to External ID, signing in via Google

Current Workaround:

We're forcing prompt=select_account on auth requests to bypass silent refresh, but this means users have to click through Google's account picker every time instead of seamless SSO.

Questions:

1. Is Microsoft aware of this issue and working on a fix?
2. Is there a configuration we're missing that would resolve this?
3. Are there other workarounds that preserve seamless SSO?

I've seen similar reports from June and November 2025 in these forums describing the exact same behaviour. Can provide network traces or additional details if helpful.

Thanks