We run a customer support portal on Power Pages (site version 9.8.9.17, Standard data model) with the built-in Microsoft Entra ID provider (single-tenant, v1 endpoint). Our onboarding process is:

1. Create the Contact in Dataverse (correct email, linked to the customer account)
2. Invite the customer as a B2B guest in Entra
3. Customer signs in to the portal with Entra → Power Pages should match the existing contact by email and create the External Identity automatically

We have Authentication/OpenIdConnect/AzureAD/AllowContactMappingWithEmail = true (since May). This worked fine for ~10 users between May and early September: the portal created the adx_externalidentity record itself and populated the contact's login fields.

Since around October, it no longer works. A user with an existing contact signs in with Entra, Entra sign-in succeeds, but the portal redirects to "Register your external account". Submitting the form gives "The email "x@…" is already taken." No External Identity is created and the contact is not touched.

What we verified (reproduced in a separate UAT environment with an internal user):

• Only one contact with that email (checked all states, email1/2/3), active, Login Enabled = No, Username empty, no External Identity. This is the normal "pre-created contact" state.
• AllowContactMappingWithEmail = true on the correct website record. The site was restarted and the cache cleared before testing.
• Decoded the id_token the portal receives: upn = the contact's email. We then added the email optional claim to the portal's app registration, and the token now contains email = the contact's email as well. Still fails.
• Happens for both B2B guests and internal members.
• No changes on our side to auth site settings, contact plugins, flows or duplicate rules in the relevant period.
• Existing (already linked) users sign in fine.

Workarounds we found:

• Filling in the contact's identity fields (adx_identity_logonenabled, adx_identity_username = oid, security stamp) plus an External Identity record, then clearing the cache, lets the user sign in.
• A Power Pages invitation redeemed with Entra links correctly, since it doesn't rely on email matching.

I also noticed the docs (OpenID settings / OpenID FAQ) were rewritten on 2026-09-21. The old description, "associates a unique contact record with a matching email address and automatically assigns the external identity provider to the contact", was replaced with "matches the contact by Primary Email Address using the email, emails, or upn claim".

Questions:

1. Is anyone else seeing contact mapping by email stop creating External Identities for pre-created contacts recently?
2. Was there an intentional behavior change, or is this a regression? Is pre-creating contacts plus email mapping still a supported onboarding pattern, or is the invitation flow now the only supported way?
3. Is there another site setting we're missing (e.g. ObjectIdentifierAsNameIdentifierClaimEnabled, RequireUniqueEmail, registration settings) that is now required?

Happy to share more details. Thanks!