How to create a new user in multi tenant App registration?

I created a multi-tenant registration app in Azure, supporting two types of tenants: one for internal users and another for external users.

My front-end application has a single login button and it can authenticate both internal and external users through my multi-tenant registration app.

I configured the authentication settings in my front-end according to Azure's guidelines, using the MSAL library.

My front-end aplication sends the request to https://login.microsoftonline.com/common endpoint that serves across all Microsoft Entra tenants.

My question is: If a new user who is not registered in any tenant wants to sign up through my front-end application, how can I ensure they are registered in the correct tenant?

For example, if the new user is internal, the user will be registered in the internal users' tenant; otherwise, the user will be registered in the external users' tenant.

Note: In a multi-tenant app registration, users from any Azure AD tenant (including external organizations) can authenticate via the https://login.microsoftonline.com/common endpoint.

• However, this doesn't allow new external users (those who don't already exist in any Azure AD tenant) to self-register when they try to log in.
• They can only authenticate if they have an existing Azure AD or Microsoft account.

Using a multi-tenant Azure AD application, you cannot show an option for new external users to sign up directly.

• When external users try to authenticate through a multi-tenant application, if they don't have an Azure AD account in any tenant, they cannot register on the login screen. They can only authenticate if they already have an Azure AD account or use a Microsoft Account (e.g., Outlook.com).

As mentioned by you, you have to make use of register external users using Azure AD B2C and set up a User Flow .

• To allow external user sign-up, you must use Azure AD B2C, which supports self-registration with customizable user flows.
• Otherwise make use of Azure AD B2B (Business-to-Business). However, this requires an invitation, and external users need to accept the invite to authenticate.