Relied on existing Entra ID SSO via AddMicrosoftIdentityWebApi for Bexmoor countersignatory. Validated approach against docs that internal user signs with SSO and Conditional Access MFA while supplier uses external email OTP.
- What worked
- Existing authentication setup reused without new configuration; separation of external email versus internal UPN was clear in code validation.
