Making Email Optional in Microsoft Entra External ID: Why This Matters for Modern CIAM

-



In customer identity, flexibility isn’t just a convenience it’s a requirement. As organizations expand globally and integrate with diverse identity providers, the assumption that every user has (or wants to provide) an email address is increasingly outdated.

Microsoft Entra External ID now supports a small but powerful capability: making the email attribute optional during sign‑up when users authenticate through a federated external OIDC provider. This change helps organizations deliver more inclusive onboarding experiences while maintaining strong identity assurance.

Why Email Became a Bottleneck

By default, Entra External ID expects an email claim during sign‑up. When an external IdP doesn’t provide one, users hit the error:

“AADSTS901011: No email address was obtained from the external OIDC identity provider during sign-up.”

This is common with:

  • Government or national digital identity systems
  • Enterprise IdPs that rely on employee numbers or unique subject identifiers
  • Privacy‑focused identity providers
  • Consumer IdPs where email is not guaranteed or not shared

Blocking sign-up because of a missing email creates unnecessary friction especially when the external IdP already provides a verified, authoritative identity.

The New Capability: Email as Optional

Microsoft Entra now allows you to make the email attribute optional at the user flow level.

This means:

  • Users can complete sign-up using only the identity provided by the external IdP.
  • You avoid the AADSTS901011 error entirely.
  • You can support identity providers that don’t issue email claims.
  • You reduce friction for users who prefer not to share email.

This is especially valuable for regulated industries, public sector services, and global consumer applications.

How It Works (High-Level)

To enable this, you update the onAttributeCollection configuration of your user flow via Microsoft Graph. The key change is setting the email attribute’s required property to false.

The update is done through a PATCH request to:

PATCH https://graph.microsoft.com/v1.0/identity/authenticationEventsFlows/{user-flow-id}

 

You must include the full attribute collection schema not just the email field when submitting the update.

Design Considerations

Removing email from sign-up changes how users perceive and interact with your identity experience:

1. Account Picker Behavior

When no email is available, the account picker displays the display name instead. Mapping the name claim or collecting a display name during sign-up helps users recognize their account.

2. Downstream Application Requirements

Some apps still rely on email for notifications, profile management, or unique identifiers. Make sure your app logic can handle accounts without email or collect email later in the user journey.

3. Federation Strategy

This capability is particularly useful when federating with custom OIDC providers that use subject identifiers, national IDs, or phone numbers as primary identity attributes.

Why This Matters for CIAM Teams

This change reflects a broader shift in customer identity:

  • Decoupling identity from email
  • Supporting global, diverse identity ecosystems
  • Reducing onboarding friction
  • Aligning with privacy-first identity models

For organizations building modern CIAM experiences, this is a meaningful step toward more adaptable and user-centric identity flows.

Final Thoughts

Email has long been treated as the universal identifier but the world has moved on to other mechanisms. Identity providers are evolving, regulatory environments are tightening, and users expect seamless sign-in experiences without unnecessary data collection.

Microsoft Entra External ID’s ability to make email optional is a small configuration change with big strategic impact. If you’re integrating external OIDC providers, this is a capability worth enabling.

Let me know your thoughts in the comments! Will you be using this for your B2C authentication?

Until next week folks!

  

Comments

Post a Comment

Popular posts from this blog

Using Custom Connectors and Microsoft Graph API's to Manage Licenses in Power Automate - Part One

-
Happy June folks! I come to you with another post, but this time I wanted to change it up and show you something else I have just finished working on. As a SysAdmin, one of the most common issues we run into is managing licenses. Working at a post-secondary institution makes this an even greater challenge, as you have both students, staff and faculty constantly coming as well as going. Managing to keep up with this constant change can introduce great administrative overhead which takes away time from important upkeep of other systems and initiatives. You may also notice this same issue in large corporations or in other government organizations. To help combat this, I wanted to create a flow that can do the following: Get the user and their licenses Determine their last sign-in and the date Conditional to determine if the user is past the "cutoff" date Remove the user from a group where the license is assigned The only problem with doing this is that Power Automate does not ha...
Read more

Using Power Automate to Update Contact Information

-
 We've all been there- you have a large organization who has out-of-date contact information. What do you do? You could go around to each department and ask them nicely to update their information, or send out an org-wide email prompting people to do so. However, this is tedious and oftentimes a pointless task. By the time you update one department, you're running to fix another. What if you could put the power back in the department's hands to do so? This is a struggle I faced recently as I was trying to find was I could conjure up some updated contact information for each department. As I did my research, I found that I was not alone in this endeavour as it seems that many IT professionals would love to make this process a little bit less painful. With this in mind, I introduce to you my latest flow! This flow will allow you to encourage users to update their contact information, without the overhead that comes with manual effort. In addition to this, this flow utilizes t...
Read more

HEADS UP: The 2027 Microsoft MFA Shift Is Coming - What You Need To Do Now

-
Microsoft is making one of its most significant identity security changes in years: retiring Microsoft‑provided SMS and voice authentication on February 1, 2027 . For many organizations, this will be a major transition and the timeline is tighter than it looks. If you’re an IT admin, identity engineer, or security leader, this shift isn’t just a technical update. It’s a strategic moment to modernize your authentication stack, reduce risk, and prepare your users for a passwordless future. Below is a clear, actionable breakdown of what’s changing and how to get ahead of it. Why Microsoft Is Retiring SMS & Voice MFA SMS and voice codes have long been the “easy button” for MFA enrollment. But they’re also the least secure : Vulnerable to SIM swapping Easily intercepted through phishing Increasingly targeted by AI‑powered social engineering Difficult to guarantee across global telecom networks Microsoft’s data shows that modern phishing kits can bypass SMS/voice MFA with alarming s...
Read more