External Identities

Hello Mohammed Ali,

Yes, this is feasible in Microsoft Entra ID, but not by directly validating another company’s credentials in your tenant.

The supported approach is Entra ID B2B collaboration (External Identities). External users are represented as guest users in your tenant, while authentication happens in their home organization. Entra ID then issues a token for your application.

How to implement:

• Enable External Identities
• Invite users as guest accounts, or configure cross-tenant access to allow B2B collaboration
• Assign users to your application (Enterprise App / App Registration)
• Configure your app to use Entra ID (OAuth2/OpenID Connect; multi-tenant if required)

Key points:

• Authentication happens in the user’s home tenant
• Guest users are created in your tenant (via invite or at first sign-in)
• No passwords are stored or synchronized
• Conditional Access and MFA can still be enforced

If the users are not part of another Entra tenant, then External ID (CIAM/B2C) would be the appropriate option.

@Sridevi Machavarapu Are you sure about this?

The table for EEID shows:

Same as workforce, except cross-tenant synchronization isn't available.

Hello RoryB,

You’re right! Cross-tenant synchronization isn’t available for External Identities.

I was referring to cross-tenant access settings for B2B, not synchronization. Those settings just control how users from another tenant can sign in. They still get created as guest users in the resource tenant (including at first sign-in).

Thanks for calling that out.