Microsoft Entra External ID
AuthenticationAdd OIDC for customer sign-in
In brief
Learn how to set up OpenID Connect as an external identity provider in Microsoft Entra External ID, enabling users to sign in using their existing accounts.
What Entra admins need to know
Review the documentation change to determine whether it affects tenant configuration, security posture, or rollout plans.
This editorial summary was generated by AI from the documentation changes. Verify important details in the full Microsoft Learn article.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
Known limitations
Issuer URI updates
Conditional Access policies that require MFA registration don't function as expected whenWhen you update the Issuer URI for an External ID tenant is federated with an externalexisting OIDC identity provider (IdP). This can result, the updated configuration might not automatically take effect in one ofuser flows. As a result, the following behaviors:IdP sign-in option might not appear on the sign-in page.
Users are unable to register an MFA method and can't complete sign-in, often encountering an error.Disable the IdP in the user flow.Users aren't redirected toSave theMFA registration (sign-up)user flow.- Re-enable the IdP.
- Save the user flow
during sign-in as expected.again.
To apply the change:
Related content
@@ -2,9 +2,10 @@ title: Add OIDC for customer sign-in description: Learn how to set up OpenID Connect as an external identity provider in Microsoft Entra External ID, enabling users to sign in using their existing accounts. ms.topic: how-to-ms.date: 09/15/2025+ms.date: 07/29/2026 ms.reviewer: brozbab ms.custom: it-pro, msecd-doc-authoring-1012+ai-usage: ai-assisted #customer intent: As a developer, devops, or it administrator, I want to learn how to add an OpenID Connect identity provider for my external tenant. ---@@ -112,10 +113,16 @@ At this point, you set up the OIDC identity provider in your Microsoft Entra ID, ## Known limitations -Conditional Access policies that require MFA registration don't function as expected when an External ID tenant is federated with an external identity provider (IdP). This can result in one of the following behaviors:+### Issuer URI updates -- Users are unable to register an MFA method and can't complete sign-in, often encountering an error.-- Users aren't redirected to the MFA registration (sign-up) flow during sign-in as expected.+When you update the Issuer URI for an existing OIDC identity provider (IdP), the updated configuration might not automatically take effect in user flows. As a result, the IdP sign-in option might not appear on the sign-in page.++To apply the change:++1. Disable the IdP in the user flow.+1. Save the user flow.+1. Re-enable the IdP.+1. Save the user flow again. ## Related content