Azure AD External Identity using SAML without invitation

Question

I am trying to setup Azure AD integration with our partner identities. I have few providers that I need to support and they support SAML and WS-Fed. I am trying to use Azure AD External Identities to add these providers to my Azure AD tenant.

However, reading through this article, it seems like SAML integrations are invitation based.

I want users to be able to login without an invitation. How can I do this with Azure AD?

Here are my needs:

1. After adding the external idp, users should be able to login using their own credentails via their idp. No additional information needed to use an app.
2. I should be able to grant them access to custom apps (mandatory) and azure resources (optional)
3. Choose what idp's are allowed per app? (if possible)

Thanks in advance.

Answer 1

Question 1: After adding the external idp, users should be able to login using their own credentials via their idp. No additional information needed to use an app.

Answer: We can implement Guest users redemption using direct link or a common endpoint instead of email invitation. A guest user clicks the app link, reviews and accepts the privacy terms, and then seamlessly accesses the app.

Using Common endpoint : Guest users can now sign in to your multi-tenant or Microsoft first-party apps through a common endpoint (URL), for example https://myapps.microsoft.com. Previously, a common URL would redirect a guest user to their home tenant instead of your resource tenant for authentication, so a tenant-specific link was required (for example https://myapps.microsoft.com/?tenantid=). Now the guest user can go to the application's common URL, choose Sign-in options, and then select Sign in to an organization. The user then types the name of your organization.

Using Direct Link: As an alternative to the invitation email or an application's common URL, you can give a guest a direct link to your app or portal. You first need to add the guest user to your directory via the Azure Portal or Powershell Then you can use any of the customizable ways to deploy applications to users, including direct sign-on links. When a guest uses a direct link instead of the invitation email, they’ll still be guided through the first-time consent experience.

Reference:

Add B2B guests without an invitation link or email - Azure AD

Invitation redemption in B2B collaboration - Azure AD

Question 2 : I should be able to grant them access to custom apps (mandatory) and azure resources (optional)

Answer: Add the Users as Guest to Azure active Directory but by default they will be sent an invitation even if they don’t open it you can assign an app in your enterprise application for them to use .

Most federated applications that support SAML 2.0, WS-Federation, or OpenID connect also support the ability for users to start at the application, and then get signed in through Azure AD either by automatic redirection or by clicking on a link to sign in. This is known as service provider-initiated sign-on, and most federated applications in the Azure AD application gallery

Reference:

End-user experiences for applications - Azure Active Directory

Quickstart: Add guest users in the Azure portal - Azure AD

To Provide the Guest user access to azure resources you can manually add a role to the users.

Question 3: Choose what idp's are allowed per app?

Answer: Create different user flows and add desired IDPs to the user flows and then assign applications registered in Azure AD to the user flows depending on which IDPs are needed for given application.

Reference:

Add a self-service sign-up user flow - Azure AD

Question 4: I added Okta as an External Identity using SAML in my Azure AD. Created an "App Registration" as multi-tenant. But I am getting this error.

AADSTS50020: User account 'xxx' from identity provider 'http://www.okta.com/xxxxx' does not exist in tenant '' and cannot access the application '0000000c-0000-0000-c000-000000000000'(Microsoft App Access Panel) in that tenant. The account needs to be added as an external user in the tenant first. Sign out and sign in again with a different Azure Active Directory user account.

Solution: Please Ensure User is added to one of the Partner Admin Groups i.e. AdminAgents in the Partner tenant.

Reference:

Manage Auth access for cloud solution providers.

Question 5: Steps for setting self service signup for an application.

Test Scenario in my Lab

• Azure AD with an application registered in application registrations blade.
• Another AD tenant with users.

Step 1: In the above external identities collaboration settings please make sure to have enable guest user self service enabled.

If it is not enabled then you can’t create a self service flow and you will get the below error when a user from other tenant is trying to access the app.

Step 2: Create a user flow by going to the user flow blade and creating a new flow.

Step 3: After you have created the user flow , click on the User flow and go to application blade and click add application.

Now search for the application you want to provide the self service signup to and click on select and you will have now enable the self service sign up for users when they try to access your application.

Output:

Once the above settings are done you can access the url to your app. Provide the user of the different ad tenant and you will get output as below .Click on create a new one .

Once the user from other AD tenant have accepted it they are successfully registered as guest users in your tenant.

If they accept the above then they will be able to access the app from now as a guest.