Hey Oliver, thank you so much for your response!! Here are a few more details but to answer your question.
yes have tried it in private mode/incognito
We're using a b2b entra portal so the users do get entered into there and are there but upon authentication in power pages that's where it dies.
affirmative, this works for gmail, yahoo, most company accounts we've tested so far (a costco company account failed but made it into the user flow). The MS personal related emails don't seem to make it into the user flow since there's no sign in logs there.
The error that the personal accounts get is, which again I just can't get my head around because if the redirect was invalid I would think this would happen to all users.
We're unable to complete your request
invalid_request: The provided value for the input parameter 'redirect_uri' is not valid. The expected value is a URI which matches a redirect URI registered for this client application.
Here is a rundown of what I have going
Entra b2b tenant/ App registration:
redirects:
https://<my-domain>/,
https://<my-doman>/signin-entraexternalid_1/
supported accounts: Any Entra ID tenant + Personal Microsoft accounts
settings: checked access tokens and ID tokens (which this says for SPA's but doesn't seem to make a difference checked or unchecked)
Endpoints: (this seems a little weird and I'm not sure the endpoints the registered app is giving me are correct)
authority url :
https://<my-domain>.ciamlogin.com/common
open ID metadata url:
https://<my-domain>.ciamlogin.com/common/v2.0/.well-known/openid-configuration
NOTE: notice the 'common' in the authority and the open id. If I use both of those in power pages I get a server error so I have to change the metadata url at the very least to
https://<my-domain>.ciamlogin.com/<My tenant ID>/.well-known/openid-configuration
OK here are the power pages settings I have:
authority url:
https://<my-domain>.ciamlogin.com/<My tenant ID>/v2.0/ (this seems to work the same if it has the tenant id or just uses the /common
reidrect url:
https://<my-domain>/signin-entraexternalid_1/
open ID metadata url:
https://<my-domain>.ciamlogin.com/<My tenant ID>/v2.0/.well-known/openid-configuration <== if I use the /common that is provided from the app registration I get a server error
if there is anything you can think of suggestions/advice I am beyond grateful, this one has got me good!
