Social Identity & CIAM Setup Guide

Purpose

Provide a canonical Synkronyx setup path for Entra External ID with federated social login. This guide aligns the project with current Entra External ID capabilities and points to a detailed runbook for Google and Microsoft sign-in testing.

Current Entra External ID Identity Provider Model

For external tenants using browser-delegated authentication:

Built-in social identity providers: Google, Facebook, Apple.
Microsoft account (live.com) customer sign-in: supported via OIDC identity provider configuration.
Organizational federation: Microsoft Entra ID tenant via custom OIDC.
Local account methods: Email + Password or Email OTP.

Note: Microsoft Learn now provides a dedicated setup path for MSA customer sign-in in External ID by configuring Microsoft account (live.com) through OpenID Connect, then enabling that provider in the user flow.

Synkronyx Delivery Guidance

Keep non-production CIAM in the sknxerodev external tenant and production CIAM in sknxeroprod.
Prefer Synkronyx-owned Google OAuth projects for any shared environment.
Use personal Google ownership only for isolated local proof-of-concept.
For live MSA customer sign-in, configure Microsoft account (live.com) as OIDC provider and add it to the ERO user flow.
Keep local account methods enabled as fallback and for break-glass validation.

Detailed Setup and Test Runbook

Use the full procedure in:

docs/39-ciam-google-microsoft-signin-runbook.md

This runbook includes:

Google OAuth project bootstrap (Synkronyx-first ownership model).
Entra External ID Google federation setup with current redirect URI requirements.
Microsoft sign-in strategy (MSA OIDC vs Entra tenant federation) and test matrix.
Environment variable mapping for local inner loop and cloud validation.