How do you configure Microsoft Entra External ID (CIAM) as a sign-in identity provider for the API Management developer portal?

Aishah-9120 20 Reputation points
2026-07-27T16:26:02.04+00:00

I have a developer portal within APIM and a standalone external tenant with users. I want users to be able to sign in to the developer portal using Microsoft Entra External ID.

Documentation for this points to Entra External ID as a recommended developer portal authentication method. E.g. Secure access to the developer portal recommends Entra External ID over Azure AD B2C for new deployments and Set up Basic Authentication to the Developer Portal states:

"…we recommend configuring a more secure authentication method such as Microsoft Entra ID or Microsoft Entra External ID, if available."

However, I can't find any identity-provider type that actually accepts a CIAM (ciamlogin.com) tenant for portal sign-in.

What I've tried:

  1. Microsoft Entra ID provider (aad): configured against the CIAM tenant. Because this provider targets the workforce endpoint (login.microsoftonline.com), CIAM consumer accounts fail sign-in with: AADSTS500208: The domain is not a valid login domain for the account type.
  2. Azure AD B2C provider (aadB2C): using the ciamlogin.com authority. This provider type is deprecated, and it requires B2C-style user-flow policy names (e.g. B2C_1_signin) that a CIAM tenant does not have. It fails with: signinPolicyName should not be empty / "policy name invalid".

Questions:

  1. Is signing into the developer portal with a standalone Entra External ID (CIAM) tenant actually supported today? If so, which identity-provider type and exact configuration should be used (given aad rejects the authority and aadB2C requires policy names CIAM lacks)?
  2. If it is not natively supported, is the documentation's recommendation of "Microsoft Entra External ID" referring only to External Identities configured in a workforce tenant (B2B self-service sign-up), rather than a separate CIAM tenant? Why does the documentation link to creating an external tenant if that was not the intention?
  3. If a separate CIAM tenant can't be used directly, how can we reuse those CIAM identities for portal sign-in?
Azure API Management
Azure API Management

An Azure service that provides a hybrid, multi-cloud management platform for APIs.

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Allan Solomon Mejia 1,460 Reputation points
    2026-07-27T18:31:21.7666667+00:00

    Hi Aishah,

    Based on the current Microsoft documentation and the behavior you've described, I don't believe a standalone Microsoft Entra External ID (CIAM) tenant is currently supported as a native identity provider for the API Management Developer Portal.

    The confusion comes from the terminology. Microsoft now uses Microsoft Entra External ID as an umbrella brand that includes:

    External Identities (B2B) in a workforce tenant

    Customer identities (CIAM) in a dedicated external tenant

    Today, APIM's developer portal identity providers still expect either:

    A Microsoft Entra ID (workforce) tenant (login.microsoftonline.com), or

    The legacy Azure AD B2C configuration, which relies on B2C user flows/policies (for example, B2C_1_signin). Those policy constructs don't exist in CIAM tenants, which explains the signinPolicyName validation error you're seeing.

    That's also why configuring the Microsoft Entra ID provider against a ciamlogin.com authority results in AADSTS500208—the workforce provider isn't designed to authenticate CIAM consumer accounts.

    At the moment, if you want to use CIAM identities, the supported options are generally:

    Use Microsoft Entra External Identities (B2B) within a workforce tenant for developer portal authentication, or

    Front the developer portal with a custom authentication layer until native CIAM support becomes available.

    Unless Microsoft has announced new support very recently, I don't believe there's a supported configuration that allows a standalone CIAM tenant to be used directly as the APIM Developer Portal identity provider.

    Please "Accept the Answer" if this information helped you. This will help us and others in the community as well.

    Was this answer helpful?

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.