Entra External ID - Unable to enable native authentication

I was able to get around it by switching to the old UI

Hello Aaron Zhong!

This is a frustrating issue and you’re not alone—other users have noticed that “Enable native authentication” for Entra External ID sometimes shows as saved, but stays disabled after refreshing, and authentication attempts continue to return AADSTS55113.

Here’s what you can do:

Check Permission/Role: Ensure your account has sufficient permissions on the tenant and the application registration to change authentication settings. Sometimes, changes silently fail if you’re not a global administrator or don’t have Application Administrator rights.

Browser/Portal Cache: Try clearing your browser cache or using an incognito window. Occasionally, the portal UI doesn’t immediately sync with backend changes.

Wait and Retry: Sometimes, changes in Entra (formerly Azure AD) portal take several minutes to propagate. Wait 10–15 minutes and refresh again.

Use Microsoft Graph API: To bypass the portal, try enabling native authentication using Microsoft Graph API or Azure CLI. Sometimes changes made through the API stick even when the portal UI is buggy.

Check Tenant and Application Type: Double-check that your application is configured for “Public client/native (mobile & desktop)” and that the tenant’s authentication policies haven’t blocked native auth for apps.

Recent Bugs/Outages: Microsoft has rolled out big changes to External ID and Entra in recent months—UI glitches and backend bugs do happen. Check Azure status or known issues for any relevant incidents.

Contact Microsoft Support: If the setting still refuses to persist—even via API—and your app still throws the native authentication error, open a support ticket with Microsoft. Share the details and screenshots so they can escalate the issue.

For now, you may want to use “Web” or “SPA” types as a workaround if your scenario supports it, until native authentication can be enabled reliably.

Best regards

Jerald Felix

Hello Aaron Zhong,
Welcome to Microsoft Q&A Platform. Thank you for reaching out & hope you are doing well.
Thanks for sharing that you were able to enable native authentication by switching back to the old Azure AD portal UI, that’s a great workaround!
Just to add:

• This is a known UI glitch in the newer Entra External ID portal experience where the “Enable native authentication” toggle doesn’t persist correctly.

• Using the old Azure portal or Azure AD classic portal often lets you save and confirm this setting reliably.

• Alternatively, you can enable native authentication via Microsoft Graph API by setting allow Public Client to true on your app registration.

• Also ensure you have sufficient admin privileges (Global Admin or Application Admin) to make this change.

Keep in mind changes might take a few minutes to propagate after saving.

If you want, here’s the Microsoft documentation on enabling native authentication via API for a smoother experience:

https://supportability.visualstudio.com/AzureAD/_wiki/wikis/AzureAD/183973/Azure-AD-Pass-Through-Authentication-(PTA)

Thanks again for sharing your solution, this will definitely help others facing the same frustrating issue!
Hope this helps. Do let us know if you have any further queries.

Please "Accept the answer" if the information is helpful to you. This will help us and others in the community as well.
Regards,

Monalisha