Support for tokens from Entra External ID when federating?

[erwinkramer]

I'm exploring the support for tokens from Entra External ID when federating to Entra ID.

I'm aware of the statement by Microsoft:

Microsoft Entra ID issued tokens may not be used for federated identity flows. The federated identity credentials flow does not support tokens issued by Microsoft Entra ID

...as explained here, but i'm unsure if that also means Entra External ID isn't supported.

In my testcase i first generate an External ID JWT, that looks like this:

{
  "typ": "JWT",
  "alg": "RS256",
  "kid": "REDACTED"
}.{
  "aud": "130d52af-6d5e-46c2-a349-98c9967ee1b9",
  "iss": "https://MY_EXT_ID_TENANTID.ciamlogin.com/MY_EXT_ID_TENANTID/v2.0",
  "iat": REDACTED,
  "nbf": REDACTED,
  "exp": REDACTED,
  "aio": "k2RgYLix2TP5/Krr2kpCaa8iDX/zXspwZEp/w/wjkMXge/RvzQ4A",
  "azp": "d2bead47-9a39-4bfd-af7b-38b0c8ae3c48",
  "azpacr": "1",
  "oid": "e83efe5c-1b21-4e93-ad36-f3e9c968ee38",
  "rh": "1.AZgAqV3SX8fihUKQ8o_lij_2Ta9SDRNebcJGo0mYyZZ-4bmYAACYAA.",
  "sub": "e83efe5c-1b21-4e93-ad36-f3e9c968ee38",
  "tid": "MY_EXT_ID_TENANTID",
  "uti": "sP4GDAr4UE2zx8kBgWcMAA",
  "ver": "2.0",
  "xms_ftd": "WdpJ2z7ZvWtJ0llQbVe3aa4IkT2aS36HiJTcWr90NvsBc3dlZGVuYy1kc21z"
}.[Signature]

Then i pass it to my Entra ID tenant (where the federation is with a user assigned managed identity), with following result:

{
  "error": "invalid_client",
  "error_description": "AADSTS700211: No matching federated identity record found for presented assertion issuer 'https://MY_EXT_ID_TENANTID.ciamlogin.com/MY_EXT_ID_TENANTID/v2.0'. Please check your federated identity credential Subject, Audience and Issuer against the presented assertion. https://learn.microsoft.com/entra/workload-id/workload-identity-federation Trace ID: 4847dc5c-d03e-4629-b2bb-64fd21e91b00 Correlation ID: 870c356d-c7ca-483f-bcfd-56ddef9d67e3 Timestamp: 2025-05-29 17:23:04Z",
  "error_codes": [
    700211
  ],
  "timestamp": "2025-05-29 17:23:04Z",
  "trace_id": "4847dc5c-d03e-4629-b2bb-64fd21e91b00",
  "correlation_id": "870c356d-c7ca-483f-bcfd-56ddef9d67e3",
  "error_uri": "https://login.microsoftonline.com/error?code=700211"
}

I'm aware which claims should match which values in the managed identity and i double checked them, but to no avail.

Thoughts:

1. Maybe it's because it's my own Entra External ID tenant, that is related to my Entra ID tenant?
2. Maybe it's just Entra ID after all? Since https://login.microsoftonline.com/MY_EXT_ID_TENANTID/.well-known/openid-configuration is pretty much interchangeable and also generates tokens just fine with the same credentials, with the only difference being a microsoftonline iss claim of course.

[erwinkramer]

I might be overthinking this, you can just configure a multi-tenant Application Registration A in tenant X, and then configure it as an Enterprise Application in tenant Y. This in itself already is like some form of 'federation'.

Then give the Enterprise Application in tenant Y some permissions in tenant Y. And if you want to go wild, you can go for this setup: https://github.com/arsenvlad/entra-cross-tenant-app-fic-managed-identity

[erwinkramer]

Not sure what i did wrong the first time, but it just works in my second attempt. Just make sure of 2 things:

1. use the following token endpoint https://<yourEntraExternalIdOrganizationName>.ciamlogin.com:443/<yourEntraExternalIdTenantId>/oauth2/v2.0/token
2. make sure to configure your app as single tenant, since that only allows the client credential flow somehow.