Entra external tenant - federation with other Entra ID tenants

in #4 how would that work, if I add another Entra ID with SAML federation.
Then I send an email invite to a user in that entra ID tenant.
Now there is manually added SAML federation with entra ID tenant and builtin federation with entra Id tenant .
Say user accept the email invite and kick off the redemption process.
How would that work when there are two different federations against the same entra id tenant

Hello Martin Kallukalam,

When a domain is both Entra-verified and configured for direct SAML/WS-Fed federation, only one federation method can be active at a time. If you have set up SAML/WS-Fed direct federation for that domain, it will take priority over the built-in Microsoft Entra ID federation.

This means that when users from that partner domain redeem guest invitations, they will authenticate through the SAML/WS-Fed identity provider you configured (such as AD FS), not directly through Microsoft Entra ID—even though the domain is Entra-verified.

You cannot have both federation methods active simultaneously for the same domain, as Microsoft Entra prevents this to avoid errors during invitation redemption.

Therefore, I suggest you choose only one federation method per partner domain—either use direct SAML/WS-Fed federation or rely on the built-in Microsoft Entra ID authentication.

If you decide to revert to Microsoft Entra ID authentication for guests from a partner domain currently using SAML/WS-Fed federation, simply remove the SAML/WS-Fed federation configuration for that domain.

Reference Documentation:

• https://learn.microsoft.com/en-us/entra/external-id/cross-tenant-access-overview
• https://learn.microsoft.com/en-us/entra/external-id/direct-federation
• https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-install-multiple-domains

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Need little bit more clarify on your comment (pls see attached screen scrape)
"

"
You are basically saying I cannot have both buitin federation of External tenant with other Entra ID tenant as well as custom created SAML federation with other Entra ID tenant .
But there is no way to turn off the External tenant's built-in federation with other entra ID tenant. So what do you mean by having to chose between the two.

Hello Martin Kallukalam,

You’re absolutely right—there is no way to turn off the built-in federation between Microsoft Entra tenants. When I said you have to “choose between the two,” I didn’t mean you can disable the built-in federation completely.

Built-in federation is the default way Microsoft Entra lets you collaborate with another Entra tenant. It uses the other tenant’s Microsoft Entra ID as the sign-in method, working behind the scenes with OIDC protocols.

Custom SAML federation is when you manually set up a special trust connection with the partner’s domain using their SAML or WS-Federation setup. This usually happens if they use systems like AD FS or another identity provider.

Now, the important part is: For each domain (like partner.com) in your tenant, only one federation method can be active at a time.

If you set up a custom SAML federation for that domain, it overrides the built-in Microsoft Entra federation. So, users from that domain will sign in using the SAML system you configured instead of the built-in method.

You might wonder if there’s a way to turn off the built-in federation. There isn’t a direct switch because it’s just how Microsoft Entra works by default. But when you add a custom SAML federation for a domain, it automatically takes over and the built-in federation stops being used for that domain’s sign-ins.

In simple terms:

• If you do not add a custom SAML federation, Microsoft Entra’s built-in federation is used.
• If you do add a custom SAML federation, that method is used instead, and the built-in one is ignored for that domain.

Kindly let us know if the above helps or you need further assistance on this issue.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

yes that is helpful.
I wish this has been clearly documented; especially "when we add a custom SAML federation to another Entra ID tenant, then the built in federation is ignored for that domain". I think this is very important aspect that is not clearly written out in the documentation for "external tenant".
If this is already documented, can you point me to that document link ?