How do you configure Microsoft Entra External ID (CIAM) as a sign-in identity provider for the API Management developer portal?

Question

How do you configure Microsoft Entra External ID (CIAM) as a sign-in identity provider for the API Management developer portal?

Aishah-9120 20

I have a developer portal within APIM and a standalone external tenant with users. I want users to be able to sign in to the developer portal using Microsoft Entra External ID.

Documentation for this points to Entra External ID as a recommended developer portal authentication method. E.g. Secure access to the developer portal recommends Entra External ID over Azure AD B2C for new deployments and Set up Basic Authentication to the Developer Portal states:

"…we recommend configuring a more secure authentication method such as Microsoft Entra ID or Microsoft Entra External ID, if available."

However, I can't find any identity-provider type that actually accepts a CIAM (ciamlogin.com) tenant for portal sign-in.

What I've tried:

Microsoft Entra ID provider (aad): configured against the CIAM tenant. Because this provider targets the workforce endpoint (login.microsoftonline.com), CIAM consumer accounts fail sign-in with: AADSTS500208: The domain is not a valid login domain for the account type.
Azure AD B2C provider (aadB2C): using the ciamlogin.com authority. This provider type is deprecated, and it requires B2C-style user-flow policy names (e.g. B2C_1_signin) that a CIAM tenant does not have. It fails with: signinPolicyName should not be empty / "policy name invalid".

Questions:

Is signing into the developer portal with a standalone Entra External ID (CIAM) tenant actually supported today? If so, which identity-provider type and exact configuration should be used (given aad rejects the authority and aadB2C requires policy names CIAM lacks)?
If it is not natively supported, is the documentation's recommendation of "Microsoft Entra External ID" referring only to External Identities configured in a workforce tenant (B2B self-service sign-up), rather than a separate CIAM tenant? Why does the documentation link to creating an external tenant if that was not the intention?
If a separate CIAM tenant can't be used directly, how can we reuse those CIAM identities for portal sign-in?

0 comments

2 answers

Your answer

Answer 1

Sridevi Machavarapu 33,660 Microsoft External Staff Moderator

Hello Aishah-9120,

From what you've described, the behavior you're seeing is expected.

Microsoft Entra ID (aad) is intended for a Microsoft Entra workforce tenant. Configuring it with a standalone CIAM (ciamlogin.com) tenant results in the AADSTS500208 error.
Azure AD B2C (aadB2C) expects Azure AD B2C user flow (policy) names. Since standalone CIAM tenants don't use these policies, errors such as signinPolicyName should not be empty are expected.

Regarding the documentation, the Microsoft Entra External ID article focuses on enabling external users within a Microsoft Entra workforce tenant, and the Secure access to the developer portal article also describes configuring external identity providers in a workforce tenant. While the terminology can be confusing, these articles don't currently describe using a standalone CIAM tenant as the developer portal sign-in provider.

If your users already exist in a standalone CIAM tenant, the recommended approach is to use developer portal delegation, where your application authenticates users against the CIAM tenant and then signs them in to the developer portal. The setup is documented here:

https://learn.microsoft.com/azure/api-management/api-management-howto-setup-delegation

Based on the available identity provider options, there doesn't appear to be support for using a standalone Microsoft Entra External ID (CIAM) tenant directly as the APIM developer portal sign-in provider. If this scenario is important for your deployment, consider submitting feedback through the Azure Feedback or documentation feedback channels so the product team can review it.

Aishah-9120 20 Reputation points

2026-08-03T13:49:18.8466667+00:00

Hi Sridevi,

Thank you for your reply. That clarifies things, I will have a look at the portal delegation.

I will point out that the words Microsoft Entra External ID quoted below from the page Set up Basic Authentication to the Developer Portal link to the page Overview: Secure your apps using External ID in an external tenant.

"…we recommend configuring a more secure authentication method such as Microsoft Entra ID or Microsoft Entra External ID, if available."

Perhaps the documentation should be updated to avoid potential confusion and misleading others.
Sridevi Machavarapu 33,660 Reputation points Microsoft External Staff Moderator

2026-08-04T01:52:08.1066667+00:00

Hello Aishah-9120,

Thank you for sharing the additional details and for bringing this to our attention.

I appreciate you pointing out the link in the Set up Basic Authentication to the Developer Portal article. I'll share your feedback with the documentation team so they can review whether the wording or the referenced documentation can be clarified for this scenario.

I'm glad the delegation approach gives you a path forward. If you have any questions while setting it up, please let us know and we'll be happy to help.

Answer 2

Hi Aishah,

Based on the current Microsoft documentation and the behavior you've described, I don't believe a standalone Microsoft Entra External ID (CIAM) tenant is currently supported as a native identity provider for the API Management Developer Portal.

The confusion comes from the terminology. Microsoft now uses Microsoft Entra External ID as an umbrella brand that includes:

External Identities (B2B) in a workforce tenant

Customer identities (CIAM) in a dedicated external tenant

Today, APIM's developer portal identity providers still expect either:

A Microsoft Entra ID (workforce) tenant (login.microsoftonline.com), or

The legacy Azure AD B2C configuration, which relies on B2C user flows/policies (for example, B2C_1_signin). Those policy constructs don't exist in CIAM tenants, which explains the signinPolicyName validation error you're seeing.

That's also why configuring the Microsoft Entra ID provider against a ciamlogin.com authority results in AADSTS500208—the workforce provider isn't designed to authenticate CIAM consumer accounts.

At the moment, if you want to use CIAM identities, the supported options are generally:

Use Microsoft Entra External Identities (B2B) within a workforce tenant for developer portal authentication, or

Front the developer portal with a custom authentication layer until native CIAM support becomes available.

Unless Microsoft has announced new support very recently, I don't believe there's a supported configuration that allows a standalone CIAM tenant to be used directly as the APIM Developer Portal identity provider.

Please "Accept the Answer" if this information helped you. This will help us and others in the community as well.