Entra External ID - Disable Local Signup while supporting Custom Identity Provider user creation

Josh Dinndorf 61 Reputation points
2025-08-27T15:05:32.9866667+00:00

We want to disable local signup but still support user creation from Custom Open ID Connect IdP providers.

This is possible in AzureB2C today. Is it possible in Entra External ID?

In Entra External ID we can disable sign up however this also prevents user creation from the identity providers when they login.

    {    
        "@odata.type": "#microsoft.graph.externalUsersSelfServiceSignUpEventsFlow",    
        "onInteractiveAuthFlowStart": {    
            "@odata.type": "#microsoft.graph.onInteractiveAuthFlowStartExternalUsersSelfServiceSignUp",    
            "isSignUpAllowed": false    
      }    
    }

Error when signup is disabled and federated user logs in. We expect this user to be seamlessly created like in AzureB2C yet prevent any user from just signing up with a local account.

AADSTS50020: User account 'demo' from identity provider 'demo' does not exist in tenant 'External ID' and cannot access the application 'app-id'(AppId - Dev) in that tenant. The account needs to be added as an external user in the tenant first. Sign out and sign in again with a different Azure Active Directory user account.

https://learn.microsoft.com/en-us/entra/external-id/customers/how-to-disable-sign-up-user-flow#disable-sign-up-flow

Microsoft Security | Microsoft Entra | Microsoft Entra External ID
0 comments No comments
{count} votes

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.