External sign-ins map to Azure AD