Azure EntraId Redeem Url for external tenants users

Jacques Boivin 0 Reputation points
2026-06-25T13:28:06.7366667+00:00

Hi,

My team and I is developing a single tenant system where users from other tenants would register. We want these users to be linked with their organization identities to achieve SSO. Currently our system perform graph API users invitations as Guest where the redeem url is emailed to the external users.

I wonder if these external users would have issues at login since these external organization tenants won't be configured as a managed tenant (Azure Microsoft Entra Id > Manage tenants).

From our testing, email with 'Federated' namespace types was able to register but at login, the following error came up:
This account does not exists in thie organization. Enter a different account or <aadSelfSignup> create a new one </aadSelfSignup>
So for 'Federated' namespace type users, we choose to use passcode and avoid linking identities with gmail accounts for example (product design choice). Then, we avoid the redeem url and use our application frontend login screen url where the user need to enter his email address to receive a passcode.

Note, our configured external identities providers are: Microsoft Entra ID, Email one-time passcode and Microsoft.

Microsoft Security | Microsoft Entra | Microsoft Entra External ID
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest

  1. AI answer

    2026-06-25T13:28:28.71+00:00

    For external users from other Microsoft Entra tenants, invitation redemption and sign-in behavior are controlled by the B2B collaboration redemption flow and your configured identity providers, not by whether those tenants are added under Manage tenants in your portal.

    Key points for the scenario:

    1. Default invitation redemption behavior
      When a guest selects the Accept invitation link, Microsoft Entra ID uses the default redemption order:
      • It first checks if the user already exists in a managed Microsoft Entra tenant (user-based discovery by UPN).
      • If SAML/WS-Fed IdP federation is configured and the user’s domain matches a configured IdP, the user is redirected to that IdP.
      • If Google federation is enabled and the domain is gmail.com or googlemail.com, the user is redirected to Google.
      • It then checks for an existing personal Microsoft account (MSA).
      • If no home directory is found and email one-time passcode is enabled, a passcode is sent to the user’s email for sign-in.
      This flow works regardless of whether the external organization’s tenant is listed under Manage tenants in your portal.
    2. Configurable redemption order for external identities
      Under External Identities → Cross-tenant access → Redemption order, the tenant can customize which identity providers are used and in what order:
      • Primary identity providers: federations (for example, SAML/WS-Fed IdP, Google federation).
      • Fallback identity providers: Microsoft account (MSA) and email one-time passcode.
      It is possible to:
      • Disable all primary identity providers and rely only on fallback providers (MSA and/or email OTP).
      • Turn off Microsoft accounts in fallback options to prevent guests from redeeming invitations with MSAs and force email one-time passcode instead.
      This aligns with the design choice described: using email one-time passcode for certain external users and avoiding linking identities with Gmail/MSA.
    3. Direct federation and “Federated” namespace users
      If SAML/WS-Fed IdP federation (Direct federation) is configured for a partner domain:
      • Users from that domain can redeem invitations and sign in using their own IdP-managed accounts without new Entra credentials.
      • Microsoft Entra redirects them to the configured IdP during invitation redemption or self-service sign-up.
      However, direct SAML/WS-Fed federation between two Microsoft Entra tenants is not supported or recommended. Even if a SAML trust is configured, Entra still uses native Entra-to-Entra B2B collaboration, not SAML. Misconfiguration (for example, issuer URL mismatch) can cause errors like AADSTS50107 during redemption.
    4. Using email one-time passcode instead of redeem URL
      For the product choice described (avoiding federation/MSA for certain users):
      • Enable email one-time passcode authentication for guests.
      • Optionally disable Microsoft accounts in fallback identity providers so guests cannot redeem with MSAs and must use OTP.
      • Guests can perform just-in-time redemption by going directly to the app’s common endpoint (for example, https://myapps.microsoft.com), choosing Sign-in options → Sign in to an organization, entering the organization domain, and then signing in via email OTP.
      In this model, using the application’s own login screen to trigger OTP-based sign-in is consistent with the documented redemption and JIT flows and avoids the issues seen with federated identities.
    5. Impact of not configuring external tenants as managed tenants
      External organizations do not need to be added under Manage tenants in the resource tenant for B2B guest invitations, redemption, and SSO via configured identity providers to work.
      What matters is:
      • Correct configuration of External Identities (cross-tenant access, redemption order).
      • Proper setup of any SAML/WS-Fed IdP federation (if used), including matching issuer URLs.
      • Enabling email one-time passcode if relying on OTP for guests.
      The error “This account does not exist in this organization…” typically indicates that the account is not recognized as a valid identity for that tenant in the chosen sign-in path, not that the external tenant must be managed under Manage tenants.

    References:

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.