domain_hint=google fails with AADSTS90023 in desktop web browsers but works in native/Android Custom Tab (Entra External ID / CIAM)

## Severity / impact

- Impact: Customers cannot be routed directly to Google on **desktop web**. They must use
  the Entra identity-provider picker (extra step). Native works fine.
- This is a basic, documented capability (issuer acceleration for social IdPs) that is not
  behaving as documented for browser-based flows.

---

## Summary / description

We use **Microsoft Entra External ID (external/CIAM tenant)**. Google is configured as a
built-in social identity provider and is enabled in the sign-up/sign-in user flow that is
associated with our application. End-to-end Google federation **works** (a user can sign
in by selecting Google on the Entra hosted page, and account linking by email works).

Per Microsoft documentation, **issuer acceleration** for social identity providers is done
by adding `domain_hint=google` to the `/oauth2/v2.0/authorize` request to route the user
directly to Google and skip the Entra identity-provider picker.

**The problem:** `domain_hint=google` works correctly from a **native app / Android Custom
Tab**, routing directly to Google. The **byte-for-byte identical** authorize URL pasted
into a **desktop web browser** (Chrome, Edge, Firefox -- all tested) fails with:

AADSTS90023: 'google' '' pair is not an external identity provider.

Note the empty string `''` as the second element of the reported pair.

We expected `domain_hint=google` to behave identically in web and native, as the
documentation does not state any client-type restriction.

### What we want to understand / resolve

1. Why does `domain_hint=google` fail in desktop browsers but succeed in native/Custom Tab
   for the same tenant, same user flow, same authorize URL?
2. Is this a known service-side limitation? Is there a tracking ID and an ETA for a fix?
3. Is there a supported parameter or configuration to achieve **direct Google routing on
   desktop web** while keeping Entra External ID as the token issuer (we do NOT want a
   custom Google OAuth that bypasses Entra)?
4. If there is no fix, please confirm the official guidance is to omit `domain_hint` on web
   and use the Entra picker, so we can document it internally.

---

## Environment / configuration

| Item | Value |
|------|-------|
| Tenant type | Microsoft Entra External ID (external / CIAM tenant) |
| Tenant subdomain | `My_Company_AICustomers` (`My_Comapny_AICustomers.ciamlogin.com`) |
| Tenant ID | `If needed I'll supply` |
| Application (client) ID | `If needed I'll supply` |
| Authority endpoint | `https://My_Comapny_AICustomers.ciamlogin.com/<If needed I'll supply>` (ciamlogin.com only) |
| Identity provider | Google (Built-in social IdP), enabled in the sign-up/sign-in user flow bound to the app |
| User flow | Sign-up/sign-in (email + password) with Google enabled; app associated |
| Redirect URI (SPA) | `http://localhost:3000/auth/social-callback` (registered) |
| Flow | Authorization Code + PKCE (`response_type=code`, `code_challenge_method=S256`) |
| Google OAuth authorized domains | `ciamlogin.com`, `microsoftonline.com` |

---

## Exact reproduction steps

1. Configure an External ID (CIAM) tenant with Google as a built-in social IdP.
2. Create a sign-up/sign-in user flow with Google enabled and associate the app.
3. Build an authorize URL with `domain_hint=google` (see below).
4. **Native / Android Custom Tab:** open the URL -> routes directly to Google. WORKS.
5. **Desktop browser (Chrome/Edge/Firefox):** open the identical URL -> `AADSTS90023`.

### Authorize request (exact, with `domain_hint=google`) -- FAILS in browser

https://my_company_aicustomers.ciamlogin.com/<GUID>/oauth2/v2.0/authorize ?client_id=<CLIENT ID> &response_type=code &redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fauth%2Fsocial-callback &scope=api%3A%2F%2F<GUID>%2Faccess_as_user%20openid%20offline_access &state=<STATE> &domain_hint=google &code_challenge=<CODE> &code_challenge_method=S256

### Error response (desktop browser)

AADSTS90023: 'google' '' pair is not an external identity provider.

Example correlation data from one occurrence (please use server-side logs to investigate):

| Field | Value |
|-------|-------|
| Request Id | `2702d9c2-3e81-4689-a0f1-c482a5991800` |
| Correlation Id | `bd7f4819-1dae-4b25-9b25-a1b08259e436` |
| Timestamp (UTC) | `2026-06-09T23:17:57Z` |

(Earlier identical occurrences: Request Id `89d04a92-0b1d-434f-ab8e-acac65a80a00`,
Correlation Id `b5785fc2-d629-46fd-b7bc-494d34739310`, Timestamp `2026-06-09T14:16:27Z`.)

### Same request WITHOUT `domain_hint` -- WORKS in browser

Removing `domain_hint=google` shows the Entra hosted page with Google listed; selecting
Google completes sign-in and returns an Entra-issued authorization code. This confirms the
Google IdP and user flow are configured correctly; only the `domain_hint` acceleration
fails on web.

---

## What we have already verified (to pre-empt first-line troubleshooting)

- The authorize request uses the `*.ciamlogin.com` endpoint only (not login.microsoftonline.com).
- Google is enabled in the **exact** user flow associated with this application.
- The same behavior occurs with Web, SPA, and Mobile/Desktop redirect URI platform types.
- The authorize URL is byte-for-byte identical between the native (success) and browser
  (failure) cases.
- `domain_hint` value is the documented short name `google` (NOT `google.com`).
- Without `domain_hint`, Google federation and account linking work end-to-end on web.
- This matches a public Microsoft Q&A thread describing the identical symptom, where a
  Microsoft moderator stated it is "most likely a service-side issue or limitation" with no
  public tracking ID.

---

## Reference: public Microsoft Q&A thread with identical symptom

Title: "domain_hint=google works from Android Custom Tab but fails from browser with
AADSTS90023 in External ID (CIAM)".

Microsoft moderator (Sridevi Machavarapu) response summary:
- The configuration and test results look valid.
- `domain_hint=google` is documented as supported issuer acceleration for social IdPs, with
  no documented native-only restriction.
- Since the identical request succeeds from Android Custom Tabs but fails in browsers, this
  is "most likely a service-side issue or limitation."
- No public tracking ID or official documentation covers this behavior.
- Recommended workaround: omit `domain_hint` on web and let users select Google on the
  Entra page.

---

## Questions for Microsoft (please answer explicitly)

1. Is there an internal bug/tracking ID for `domain_hint=<social-idp>` failing in
   browser-based CIAM authorize requests with `AADSTS90023`? If so, what is the ETA?
2. Is there ANY supported way to achieve direct Google routing on **desktop web** while
   keeping Entra External ID as the issuer (e.g., a different parameter, a user-flow
   setting, a custom URL domain configuration, or a custom policy)?
3. Is the documented `domain_hint` issuer-acceleration behavior expected to support
   browser clients, or should the docs be updated to state a native-only limitation?
4. Can you confirm the recommended production guidance so we can document it internally?

---

## Current mitigation in our app

Until Microsoft resolves this, our backend omits `domain_hint` for standard web browsers
(falling back to the Entra hosted picker, one extra click) and sends `domain_hint=google`
only for native/embedded-webview clients, which honor it and go directly to Google. We
would prefer to remove this branching once `domain_hint` works in browsers.