Integrate an external identity provider for an Entra ID verified domain

Question

Integrate an external identity provider for an Entra ID verified domain

Shayan Sarkar 25

I am trying to set up an external IdP as the authentication mechanism for a domain in my Entra domain, and I am running into some issues, and wanted to validate the steps.

What I would like to do is set up a domain <user_name>@test.example.com that would be one of the custom domain names within my account. After that, a user would be able to go to https://potal.azure.com/test.example.com and it would route them to the external IdP to authenticate before coming back into Azure.

These are the steps that I have done so far

Added and verified the custom domain name, test.example.com, by adding the "MS=msXXXXXX" TXT record
In External Identies I added a new external SAML Identity provider, the domain of the IdP does not match test.example.com
I tried to add test.example.com as an additional domain, by adding the DirectFedAuthUrl TXT record but I receive the following error.

This domain is Microsoft Entra verified. You will need to configure cross-tenant access inbound settings for users to sign in with SAML/Ws-Fed identity provider instead of Microsoft Entra ID.

As a separate check, I added a complete separate domain "anotherdomain.example.com" to the external identity provider. I added the DirectFedAuthUrl TXT record and I was able to add it. However, since this isn't the domain I want to use for access to Azure, it isn't what I am looking for.

So my question is if I wanted to log into the azure portal for my Entra verified domain via an external SAML IdP, are the steps that I am following correct? Or is there another process I should follow?

VEMULA SRISAI 14,065 Reputation points Microsoft External Staff Moderator

2026-01-08T17:42:03.9433333+00:00
It sounds like you're on the right track trying to integrate an external SAML Identity Provider (IdP) for your Entra domain. Here’s a breakdown of your situation and some guidance on the steps you've taken so far:

Steps You've Taken:

Added and Verified Custom Domain: Great job verifying the custom domain test.example.com!

Configured External SAML IdP: You’ve added an external SAML IdP, but it sounds like there’s a mismatch in the domain.

Encountered an Error: The error message you received indicates that you need to configure cross-tenant access inbound settings.
Suggested Next Steps:
To successfully log into Azure using your Entra verified domain with an external SAML IdP, you’ll want to ensure that you've set the following correctly:

Cross-Tenant Access:

Check the cross-tenant access settings in Azure. You might need to configure settings under External Identities in the Entra admin center, enabling users from the external IdP to access your resources. More information can be found in the documentation about cross-tenant access.

SAML Configuration:

Verify that the SAML settings in your external IdP align with those configured in Azure. Ensure that the SAML Assertion contains the required claims and is signed correctly, as Azure expects specific data from the IdP.

Direct Benefits:

Since you have experience adding another domain successfully, ensure the configurations are consistent across both domains for troubleshooting.

Follow-Up Questions:

To help you more effectively, could you provide some additional details?

What specific IdP are you using, and have you verified its configurations in relation to Azure?

Can you share what claims you are including in your SAML response?

Have you set the required permissions and roles for users from the external IdP in Azure?

Hope this helps you move forward, and let me know if you have further questions or need more assistance!

References:

Microsoft Entra External ID Overview

Authorize Developer Accounts using Microsoft Entra External ID

Cross-Tenant Access Configuration

Feel free to dive into those links for more detailed guidance!
VEMULA SRISAI 14,065 Reputation points Microsoft External Staff Moderator

2026-01-09T18:06:50.7266667+00:00

Shayan Sarkar Did you get a chance to see my previous comment? Please feel free to reach out if you have any further questions or need any additional information or assistance from my side.
Atul Kishor Gupta 0 Reputation points

2026-02-13T06:16:04.19+00:00

Hi @Shayan Sarkar

Have you found solution to your issue? I am facing the same issue.

@VEMULA SRISAI

I am trying to add custom SAML IdP (OKTA) whose passive authentication URL does not have the domain that I need to configure. And the domain that I need to configure is already verified in another Entra tenant that does not belong to me.

With this scenario, what can be done to set up federation with third party IdP

1 answer

Your answer

VEMULA SRISAI 14,065 Reputation points Microsoft External Staff Moderator

2026-01-09T18:06:50.7266667+00:00

Shayan Sarkar Did you get a chance to see my previous comment? Please feel free to reach out if you have any further questions or need any additional information or assistance from my side.
Atul Kishor Gupta 0 Reputation points

2026-02-13T06:16:04.19+00:00

Hi @Shayan Sarkar

Have you found solution to your issue? I am facing the same issue.

@VEMULA SRISAI

I am trying to add custom SAML IdP (OKTA) whose passive authentication URL does not have the domain that I need to configure. And the domain that I need to configure is already verified in another Entra tenant that does not belong to me.

With this scenario, what can be done to set up federation with third party IdP

Answer 1

To integrate an external identity provider (IdP) for an Entra ID verified domain like test.example.com, you need to follow specific steps to ensure proper configuration. Here’s a summary of the correct process based on your description:

Domain Verification: You've correctly added and verified the custom domain test.example.com using the TXT record.
Adding the External IdP: When adding the external SAML IdP, ensure that the IdP is configured correctly and that you have the necessary details such as the Issuer URI and the authentication endpoint.
Cross-Tenant Access: The error message you received indicates that you need to configure cross-tenant access inbound settings. This is necessary for users to sign in with the SAML/WS-Fed identity provider instead of Microsoft Entra ID. You will need to set up these settings in the Microsoft Entra admin center.
DirectFedAuthUrl TXT Record: Ensure that the DirectFedAuthUrl TXT record is correctly configured for test.example.com. This record is crucial for establishing the trust relationship between your domain and the external IdP.
Testing with Another Domain: Since you were able to add anotherdomain.example.com, it suggests that the configuration for external IdPs is working, but the specific settings for test.example.com need to be correctly aligned with the cross-tenant access requirements.
Final Steps: After configuring the cross-tenant access settings and ensuring the correct TXT records are in place, users should be able to authenticate through the external IdP when accessing the Azure portal via https://portal.azure.com/test.example.com.

If you continue to face issues, reviewing the specific configurations of the external IdP and the cross-tenant access settings will be essential. You may also want to consult the Microsoft documentation for detailed steps on configuring SAML/WS-Fed identity providers and cross-tenant access.

References:

Integrate an external identity provider for an Entra ID verified domain

Steps You've Taken:

Suggested Next Steps:

Follow-Up Questions:

References:

1 answer

Your answer