Microsoft Entra External ID – Authentication and MFA guidance

Hi All,

We are evaluating Microsoft Entra External ID as the identity provider for our existing customer-facing web application, and need guidance on the supported MFA methods for local (email + password) users, specifically whether the Microsoft Authenticator app can be used as a second factor.

Our architecture

• Tenant type: Microsoft Entra External ID (External tenant)
• App: Angular SPA + Web API backend
• User provisioning: Users are created via Microsoft Graph API from our application's registration form (not self-service sign-up). We call Graph to create the user object.
• Two categories of end users:
  1. Local users – authenticate with email + password issued in our External ID tenant.
  2. Federated users – authenticate via their own IdP (SAML/OIDC federation).
• IdP selection: Based on the email address domain entered at user creation time, we decide whether the account is local or federated (home realm discovery style routing).

MFA requirement

For local users only, we want to offer the following second factors:

1. Microsoft Authenticator app
2. SMS (phone)
3. Email OTP

Federated users will continue to satisfy MFA at their own IdP.

Questions

1. Authenticator app support: Is the Microsoft Authenticator app available as an MFA method for local users in an Entra External ID tenant today (using user flows)? The primary authentication used is Email + Password. The Microsoft Authenticator method is listed under Authentication method policies and enabled. A Conditional Access policy requiring MFA has been configured. However, at sign-in, the MFA prompt only offers either Email OTP or SMS — Authenticator is never presented.
2. Roadmap: Is Authenticator support on the public roadmap for External ID? Any timeline or roadmap link?
3. Graph provisioning:
   • When we create users via Graph in an External tenant, is there a supported way to pre-register (the user is prompted to enroll on first sign-in) or require registration of Authenticator on first sign-in?
   • Which Graph endpoint should we use to manage authentication methods for users (/users/{id}/authentication/microsoftAuthenticatorMethods, /softwareOathMethods, /phoneMethods, /emailMethods)? Are all of these supported against External ID tenants, or only Workforce tenants?

Any confirmation from the product team, working samples, or documentation links specifically for External ID (not B2C, not Workforce) would be very helpful.

Thanks in advance!