I’ve inherited a high-level design for a single-page application hosted in azure that serves external users, but I’m facing challenges with implementing a crucial feature. The application needs to allow authorized external users to perform user administration tasks (like adding/removing users and granting predefined permissions) but restricted to their own organization. Our backend user store is Entra id.
We also have internal users who require broader administrative roles covering all users and organizations.
Currently, I see two potential solutions:
1. Grant authorized external users access to our Azure tenancy with restricted permissions specific to their organization. However, I have security concerns about external users logging into our tenancy.
2. Develop a custom identity and access management application.

Are there other solutions or best practices I might be overlooking? Your insights would be greatly appreciated.
Thank you!