How to give external customer accounts in a entra external id tenant access to a a web api in my internal tenant?

Question

I have an internal tenant A where I have internal resources (web api, functions, database, admin website etc).

Recently I created an external tenant B with Microsoft Entra External id for customers. There I have registered a SPA app where external customers can register and login with email and a code sent to their email. I use msal with the config:

auth: {
    clientId: "xxxx",
    authority: "https://xxxx.ciamlogin.com",
    redirectUri: "/dashboard", 
    postLogoutRedirectUri: "/",
    navigateToLoginRequestUrl: false,
  },

Login works fine for all types of accounts on the external customer website but when I try to get an access token with aquireTokenSilent to get data from my web api in the internal tenant I get AADSTS500207: The account type can't be used for the resource you're trying to access.

If I change the authority in the msal config to https://login.microsoftonline.com/organizations/v2.0 I get a working access token with the right scope but then I can only login to the external customer website with my work account which is not what I want. I have also tried https://login.microsoftonline.com/common/v2.0 but cannot login with personal or other accounts there either.

I have set "signInAudience" to "AzureADandPersonalMicrosoftAccount" both the app registrations in tenant A and B. I have also added api permission which works correctly when I set authority to https://login.microsoftonline.com/organizations/v2.0

I have searched in the documentation and tried all sorts of possible solutions but nothing works. Is it possible to give external customer accounts access to the web api in my internal tenant?

Answer 1

@Jenny Pettersson

Thanks for your time and patience on this. I was able to validate the behavior with my resources and got to know that as of today accessing API of workforce tenant from external tenant (CIAM User) is not supported.

However considering the feature to be new, we are open for feedback and request you to post this as an idea on our feedback forum so that it could be visible to the service engineering team.

Let me know once this is posted with the link so that I could vote for it and notify the team to have a look.

If you don't have any further queries and the suggestion works as per your business need. Please "Accept the answer (Yes)" and "share your feedback ". This will help us and others in the community as well.

Thanks,

Akshay Kaushik