3.3.3. External Identity Providers
💡 First Principle: Meet collaborators where their identities already live. Every additional IdP you federate with removes a password your partners would otherwise create (and forget, and reuse) — the redemption ladder is really a preference order over whose authentication you'll accept.
The configurable providers: SAML/WS-Fed identity provider federation ("direct federation") for partners with their own non-Entra IdP (ADFS, Okta, Shibboleth) — you exchange metadata (their passive endpoint, certificates; domain verification rules apply), and their users redeem invitations against their corporate IdP with no Microsoft account involved. Google federation lets Gmail-identified guests use Google sign-in; Microsoft account covers consumer MSAs; email one-time passcode is the universal fallback (code to inbox, no account creation) — enabled by default for tenants that haven't opted out, and the answer for "partner has no IdP at all."
Order of evaluation at redemption: home Entra tenant → SAML/WS-Fed federation → Google (for gmail addresses) → MSA → email OTP. Configuration lives in External Identities → All identity providers; SAML/WS-Fed federation is per-domain (and that domain must not be DNS-verified in your tenant).
Self-service sign-up user flows stitch providers into app onboarding: an app you publish to externals presents a sign-up page listing enabled IdPs, collects attributes you define, and can call API connectors for approval/validation steps mid-flow.
⚠️ Exam Trap: SAML/WS-Fed external IdP federation (guests from a partner using their own IdP) is a different feature from configuring a federated domain for your own workforce (3.4's AD FS territory) and from SAML SSO to an enterprise app (Phase 4, where Entra is the IdP). Three SAMLs, three directions — match the arrow before answering.
Reflection Question: A partner engineering firm uses Okta; a tiny design vendor uses only Gmail; a rural supplier has bare email. For each, name the redemption path a well-configured tenant offers — and what single default setting covers the last one.