Self-registration with Entra ID within an external tenant

If you have Entra ID tenant X and Entra External ID tenant Y, you can use "Create new external user" on Y to create a user called ******@x.onmicrosoft.com. But that user is a member of Y (local account) - not a federated one.

If you try and self-register on Y with ******@x.onmicrosoft.com, you will be asked to verify the OTP and enter whatever sign-up attributes are configured but the user has a userType of "Member" and so will be a local account.

The user's identity contains only an email address and a UPN.

The only way to get federation and use tenant X credentials is to create a guest account via email invite.

This is clearly described in the docs:

"Note

The Microsoft Entra ID Sign up option is unavailable because although customers can sign up for a local account using an email from another Microsoft Entra organization, Microsoft Entra federation isn't used to authenticate them. Google and Facebook become available only after you set up federation with them. Learn more about authentication methods and identity providers."

https://dori-uw-1.kuma-moon.com/en-us/entra/external-id/customers/how-to-user-flow-sign-up-sign-in-customers

So if the user signs up with ******@x.microsoft.com and uses the same X password, they can still log in, but if they change the X password, that won't be reflected in Y.