Azure AD as SAML IdP not working with Entra External ID (domain-based federation not triggering)

Description:

I am trying to configure Azure AD (Entra ID) as an external SAML Identity Provider for Microsoft Entra External ID (CIAM), but domain-based federation is not working as expected.

Setup Details:

Azure AD (Source IdP):

Created a SAML application (SAML toolkit / enterprise app)

  Using:

  
        Issuer: `https://sts.windows.net/<tenant-id>/`

        
              SSO URL: `https://login.microsoftonline.com/<tenant-id>/saml2`

              
                    Metadata: `https://login.microsoftonline.com/<tenant-id>/federationmetadata/2007-06/federationmetadata.xml`

                    
                          Certificate: extracted from metadata

Entra External ID (Target Tenant):

Added a custom SAML/WS-Fed Identity Provider

  Configured:

  
        Metadata URL (tenant-level, no appid)

        
              Issuer + SSO URL

              
                    Certificate

                    
                          Domain: `example.com`

DNS Configuration:

Added TXT record on domain:

   DirectFedAuthUrl=https://login.microsoftonline.com/<tenant-id>/saml2

  Verified via `nslookup` (record resolves correctly)

Expected Behavior:

When a user enters an email like:

user@example.com
yaml

→ Entra External ID should:

Detect domain

Trigger SAML federation

Redirect user to Azure AD login page

---

**Actual Behavior:**

No redirection occurs

User remains on the External ID sign-in page

Error shown:

ruby
We couldn't find an account with this email address

→ This indicates the system is attempting local account lookup instead of triggering federation.

Troubleshooting Done:

Verified domain spelling and configuration

Recreated SAML Identity Provider

Switched to tenant-level metadata (removed appid)

Confirmed DNS TXT record propagation

Tested with multiple users from same domain

Question:

Is Azure AD supported as a SAML Identity Provider for Entra External ID (CIAM) using domain-based federation?

Or is there a known limitation where:

Azure AD cannot be reliably used as a SAML IdP in this scenario

Domain-based federation does not trigger for Azure AD IdPs

Additional Context:

If this scenario is not supported, should OpenID Connect (OIDC) be used instead for Entra-to-Entra federation?

Goal:

Enable users from an Azure AD tenant to authenticate into an Entra External ID tenant using federation.

Any clarification on supportability or recommended approach would be appreciated.