Entra External ID features missing on one tenant

Question

Hello,

In my test default tenant, when I set up Entra External ID as a Global Administrator, I can access all available features. However, in my client’s Entra External tenant, where I have the roles of Application Administrator and Cloud Application Administrator, I notice several features are missing.

The missing features include but are not limited to:

• Conditional Access
• Custom Extension Submit options
• Submit & Run User Flow button
• Features labeled as "(Preview)"
• etc

I would like to understand why these features are unavailable in my client tenant and how I can enable them.

Thank you for your assistance.

Answer 1

Hello @Vedran Opančar - dotSource SE,

Thank you for posting your query on Microsoft Q&A.

As @Abiola Akinbade mentioned, the difference between your test tenant and the client’s tenant is due to the roles assigned to your user account. In your test tenant, you can perform actions in the External ID tenant because you have the Global Administrator role. However, in the client’s tenant, where you only have the "Application Administrator" and "Cloud Application Administrator" roles, you lack the necessary permissions to manage or make changes to Entra features.

To manage conditional access policies, you need to have at least the Conditional Access Administrator or Security Administrator role assigned.

https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/delegate-by-task#security---conditional-access

To manage user flows, your account must have the External ID User Flow Administrator role.

https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/delegate-by-task#external-identitiesb2c

Additionally, if you are encountering any error messages when trying to create a Custom Authentication Extension (Preview), please share a screenshot of the error. This will help us troubleshoot the issue more effectively.

You also mentioned that some features currently in Preview are unavailable for use. Could you provide more details about these options so we can investigate and provide further guidance?

I hope this information is helpful. Please feel free to reach out if you have any further questions.

Thanks,
Raja Pothuraju.

Answer 2

Hello Vedran Opančar - dotSource SE,

Thanks for your question

This is an RBAC issue. The discrepancies you’re observing between your test tenant and your client’s Entra External ID tenant are likely due to the differences in the roles assigned to you in each environment. 

For example To manage Conditional access you need at least the Conditional Access Administrator role as the cloud application administrator does not have the needed ppermissions for CA management:

See: https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/permissions-reference#conditional-access-administrator

To resolve the issue, for what you need on the tenant you need to have the appropriate roles assigned.

You can mark it 'Accept Answer' and 'Upvote' if this helped you

Regards,

Abiola