Managing external identities to enable secure access for partners, customers, and other non-employees
Yes. A different user account can be added as an owner of the enterprise application, including another organizational account, as long as the person performing the change has the required Microsoft Entra role.
For an enterprise application, the supported way is:
- Sign in to the Microsoft Entra admin center as at least Cloud Application Administrator or Application Administrator.
- Go to Entra ID > Enterprise apps > All applications.
- Select the enterprise application.
- Open Owners.
- Select Add.
- Search for and select the user account to add as owner.
- Select Select.
Important points for the scenario described:
- If the current owners cannot sign in with their existing accounts, an administrator with Cloud Application Administrator or Application Administrator can still assign a new owner.
- If the goal is to manage token configuration or other enterprise app settings, adding a new working account as owner is a valid approach.
- If the account being added is not an admin, it can still be made an owner by an administrator.
- If Restrict access to Microsoft Entra administration portal is set to Yes, non-admin users cannot use the Entra admin center to manage applications they own.
- Microsoft notes that owners added by Graph API or PowerShell might not be able to manage some enterprise application settings such as attributes and claims, configured SAML certificate properties, or token encryption settings. For this reason, for settings work in the portal, adding the owner through the Entra admin center is the better option.
If no current owner can act, the practical path is:
- Have a Cloud Application Administrator, Application Administrator, or another highly privileged administrator open the enterprise application.
- Add the required
@microsoftuser account as an owner in Owners. - Sign in with that newly added account and manage the application settings.
If there are no usable owners at all, a privileged administrator in the organization must assign the new owner.
- Assign enterprise application owners (portal)
- Overview of enterprise application ownership in Microsoft Entra ID
- Enable SAML single sign-on for an enterprise application
- Unable to assign owner to Enterprise Application - Microsoft Q&A
- Request for Assistance to Add Owners to Enterprise Application in Azure - Microsoft Q&A