During a logon attempt from Okta where the user is expected to be routed to an Entra IDP for authentication, Okta routes to the correct Entra IDP but then the following happens:

• The user is unexpectedly redirected by Entra to the Okta tenant's federated Microsoft 365 (M365) / Office 365 WS-Federation application.

• The user is forced to authenticate against the corporate M365 application, which is unsuccessful or incorrect because the user's actual target Entra ID account uses a different domain suffix than their Okta login suffix.

• The user is blocked from entering their correct Entra ID credentials because they have been auto-accelerated away from the Microsoft login screen and routed back to Okta.

Adding a domain_hint parameter to the Authorization endpoint URL prevents this undesired routing from occurring.

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Identity Provider (IdP) Routing Rules
• Microsoft Entra ID (formerly Azure AD) configured as an inbound OIDC Identity Provider
• Microsoft Entra Home Realm DIscovery (HRD)

This behavior occurs due to the interaction between the standard Okta OIDC login_hint propagation and the Microsoft Entra ID HRD engine.

In detail:

1. When evaluating an IdP routing rule, Okta automatically captures the Okta login identifier of the user (for example, <user@company.com>) and passes it to the outbound OIDC /authorize request as the login_hint query parameter in the redirect to the IDP.
2. As Microsoft Entra ID processes the login_hint if the domain suffix of the provided hint exists as a federated domain inside the Microsoft tenant, the Microsoft Entra HRD engine automatically accelerates the authentication request back to that federated identity provider (for example, an Okta M365 application).
3. This causes a problem when the Okta login of the user uses the federated domain suffix (<company.com>) but the target account they need to authenticate with Microsoft Entra ID uses a different domain suffix (e.g. <user@partnerdomain.com>).
4. Because Microsoft Entra ID auto-accelerates based on the login_hint domain before the user can type the actual Microsoft Entra ID username, Microsoft Entra ID routes the user incorrectly.

NOTE: Microsoft Entra ID explicitly ignores standard override parameters such as prompt=login when a federated domain processes via the login_hint.

How does an administrator override the Microsoft Entra ID routing context?

To prevent Microsoft Entra ID from evaluating the login_hint domain suffix for corporate auto-acceleration, an administrator must override the Microsoft Entra ID HRD routing context. Appending a domain_hint parameter to the outbound OIDC authorization endpoint in Okta tells Microsoft Entra ID which tenant type or directory to target. This intercepts the automatic federated acceleration and forces Microsoft to display the standard login or account selector screen, allowing the user to enter the actual Microsoft Entra ID username.

Navigate to the Identity Providers section in the Okta Admin Console, edit the Microsoft Entra ID OIDC Identity Provider, and append the domain hint parameter to the authorization endpoint URL by following these steps.

1. Navigate to the Okta Admin Console.
2. Go to Security and select Identity Providers.
3. Locate the Microsoft Entra ID OIDC Identity Provider and click Edit.
4. Scroll down to the Endpoints section and locate the Authorization endpoint field.
5. Append domain_hint=partnerdomain.com (or the expected Entra domain suffix for the affected users) directly to the URL using standard URI query syntax.
   • If the URL has no existing parameters, add it with a ?:
     https://login.microsoftonline.com/<tenant-id>/oauth2/v2.0/authorize?domain_hint=partnerdomain.com
   • If the URL already contains a query parameter, append it with an &:
     https://login.microsoftonline.com/<tenant-id>/oauth2/v2.0/authorize?existingparam=value&domain_hint=partnerdomain.com  
6. Click Save to apply the configuration.

Microsoft Entra ID receives both login and domain hints.

Once configured, the next time the IdP routing rule evaluates, the user redirects to Microsoft Entra ID with both login_hint and domain_hint present. Microsoft Entra ID honors the domain_hint over the login_hint domain federation rules, halting the auto-acceleration to the corporate M365 application and prompting the user to enter the actual target Microsoft Entra ID credentials.

Related References

• Home Realm Discovery Policy