Self registration portal in Entra ID for Guest accounts

SAGA 45 Reputation points
2026-08-21T10:59:29.85+00:00

Hi,

In entra ID is it possible to setup a self registration portal for the guest account so can use that and register the accounts in entra ID instead of the admin sending the guest invite manaully. If there is such optioin how to enable that and what is the licensing requirement

Microsoft Security | Microsoft Entra | Microsoft Entra External ID
0 comments

2 answers

Sort by: Oldest
Most helpful Newest Oldest

  1. AI answer

    2026-08-21T10:59:46.9066667+00:00

    Yes. Microsoft Entra supports this through self-service sign-up user flows for B2B collaboration, so external users can sign themselves up for access instead of an admin sending each guest invitation manually.

    Key points:

    1. What it does
      • External users can sign up for applications or resources themselves.
      • After they complete sign-up, they are represented in the directory as a B2B collaboration user object, typically with user type set to Guest.
      • Microsoft Entra accounts are supported as an identity provider option by default for B2B collaboration. No extra configuration is required for guests to sign in with their work or school account.
    2. How to enable it
      • Sign in to the Microsoft Entra admin center as at least a User Administrator.
      • Go to Entra ID > External Identities > External collaboration settings.
      • Set Enable guest self-service sign up via user flows to Yes.
      • Select Save.
    3. What happens next
      • After enabling the tenant setting, user flow controls become available so the sign-up flow can be associated with an application.
      • This is the feature used to create the self-registration experience for guest users.
    4. Licensing / requirements
      • For the guest and partner access governance deployment scenario, the documented requirements include:
        • Microsoft Entra ID P1 or P2
        • Microsoft Entra ID Governance SKU
        • Two tenants: source and target
        • A cloud user in the source tenant to request access
        • A cloud user in the target tenant to approve and access
        • An account in the target tenant with one of these roles: User Administrator, Identity Governance Administrator, Privileged Role Administrator, or Global Administrator
      • The documentation also notes that self-service sign-up can be enabled at the tenant level and configured through the portal or Microsoft Graph.
    5. When to use this vs invitation flow
      • Use invitation flow when admins want to add guest users directly.
      • Use self-service sign-up user flows when end users should initiate their own registration.
      • If approval workflows, access packages, lifecycle automation, or organization-scoped requests are needed, entitlement management is the documented option for those scenarios.

    References:

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

  2. Bence Weiszmann 1,555 Reputation points
    2026-08-21T17:58:53.4233333+00:00

    Dear @SAGA

    Yes, this is possible with Microsoft Entra ID, but there are two different approaches depending on how much control you need over the registration process.

    For a straightforward self-service registration experience, you can use Microsoft Entra B2B self-service sign-up. This allows external users to register themselves for access to an application instead of requiring an administrator to manually send each guest invitation. Once the user completes the sign-up flow, Microsoft Entra ID creates the guest user in your workforce tenant. Microsoft Learn – Self-service sign-up overview

    To enable it:

    1. Go to Microsoft Entra admin center.
    2. Navigate to Entra ID > External Identities > External collaboration settings.
    3. Under Enable guest self-service sign up via user flows, select Yes and save the configuration. Microsoft Learn – Configure external collaboration settings
    4. Create a self-service sign-up user flow and associate it with the application that external users need to access.

    Configure the identity providers and user attributes you want to collect.

    Microsoft Entra accounts are supported as an identity provider by default, so an external user with a work or school account can use their existing Entra ID identity during the sign-up process. Microsoft Learn – Microsoft Entra accounts as an identity provider

    One important limitation is that this isn't a generic replacement for the normal Invite guest experience for Microsoft 365 resources. The self-service user flow is associated with an application, and Microsoft notes that user flows can't be used for Microsoft applications such as SharePoint or Teams. Microsoft Learn – Self-service sign-up overview

    Licensing

    The basic B2B self-service sign-up capability should not be confused with Microsoft Entra ID Governance / Entitlement Management. If the requirement is simply to allow an external user to register themselves and create a guest account, Entra ID Governance is not required just for this functionality.

    However, if you need a controlled access-request process, for example, approval, access packages, automatic group/application assignment, expiration, access reviews, or lifecycle management, then Microsoft Entra Entitlement Management is the more appropriate solution. Microsoft Learn – Self-service access portal

    If you need an approval step before granting access, Microsoft also supports integrating approval workflows with the self-service sign-up flow through API connectors. Microsoft Learn – Add approvals to self-service sign-up

    If this answers your query, please click Accept Answer and Upvote if you found it helpful. If you have any further questions, feel free to let us know.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.