Inviting an External User 

To allow external users access to your instances of Foundation as a Guest User they must exist as a user within your Entra ID. If the user doesn't exist then they will need to be added as follows. Please note that the signInAudience for the 'Foundation Cloud for Energy' prevents personal accounts (i.e. hotmail, live, outlook, gmail, yahoo, etc.) from being allowed as guest users.


Log into the Microsoft Entra Admin Center.


From the side menu expand Manage and select the Users screen

Click the New User button and select the Invite external user option

A new screen will be presented where the External email address must be supplied, and it is recommended that their Display name is populated.


Switch to the Properties tab and set the User Type as Guest. Any other informational can also be added as required

Finally on the Review + Invite tab a summary of the user to be created is shown

Clicking the Invite button at the bottom will complete the creation of the user and send them an invitation for access. To give the new user the best experience it is recommended that their Foundation Instance Role assignments are now setup.


Guest User Username Format

When users are provisioned from Entra ID (Azure AD) through SCIM, guest users have a different username format than regular tenant users. 


Guest usernames appear in the format: originaluser_domain.com#EXT#@yourtenant.domain. 


Why are Usernames of this Format

  • Guest users in Entra ID are assigned a special User Principal Name (UPN) that includes the #EXT# identifier
  • ENERGYSYS' system uses this guest UPN as the username to ensure uniqueness, since the same individual could be a guest user across multiple Entra tenants
  • Prevents username conflicts when the same person has guest access to different organisations
Example: If john.smith@company.com is invited as a guest to your Entra tenant, their username in our system will appear as: john.smith_company.com#EXT#@yourdomain.com


Note: The domain after #EXT#@ will match whatever primary domain is configured in your Entra tenant (this could be yourorg.com, yourorg.onmicrosoft.com, or any other verified domain).


This is expected behaviour and ensures proper, unique, user identification and access management across different tenant environments.


For guest user access we recommend users access from a private browsing window.


Reviewed: August 2025