Entra External ID tenant creation blocked by ARM EU data boundary: Europe rejected, North Europe unsupported

I’m trying to create a Microsoft Entra External ID external tenant for customer authentication, hosted in Europe and billed through our existing Azure subscription.

Creation fails because the External ID resource’s geographic location appears incompatible with our existing tenant’s Azure Resource Manager EU data boundary.

Environment

• Existing Microsoft Entra workforce tenant.
• ARM data boundary explicitly configured as European Union. The portal says this configuration cannot be modified or deleted.
• Existing Azure subscription, with plan shown as Microsoft Azure Plan.
• Existing resource group located in North Europe.
• My account is a Global Administrator in the workforce tenant and Owner of the subscription.
• IAM shows no deny assignments at the resource-group scope.

Portal reproduction

1. Open Manage tenants and choose Create.
2. Select External, then Use Azure subscription.
3. Enter the tenant name and domain, selecting Netherlands as Country/Region.
4. Select the existing subscription and resource group.
5. Submit creation.

Creation fails with this error excerpt:

InvalidResourceLocation

Invalid resource location 'europe'. The tenant id for the given
subscription is opted into the 'EU' data boundary. The resource
location is restricted by the data boundary.

The error then lists concrete Azure regions, including northeurope and westeurope, but not europe.

REST reproduction

I also tried creating the resource directly:

PUT https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.AzureActiveDirectory/ciamDirectories/{domain}.onmicrosoft.com?api-version=2023-05-17-preview

Using:

• location: Europe
• SKU name: Base
• SKU tier: A0
• properties.createTenantProperties.countryCode: NL
• properties.createTenantProperties.displayName: the desired tenant name

This returns the same InvalidResourceLocation error.

Changing the resource location to northeurope instead produces:

LocationNotAvailableForResourceType

The provided location 'northeurope' is not available for resource type
'Microsoft.AzureActiveDirectory/ciamDirectories'.

That response lists these available locations:

global, unitedstates, europe, asiapacific, australia, japan

The failed creation event in Azure Activity Log confirms HTTP 400 Bad Request, error code InvalidResourceLocation, and the same EU boundary explanation. There are no additional nested errors.

ARM deployment validation with ProviderNoRbac succeeded for the Europe configuration, but actual resource creation still failed.

Question

What is the supported way to create a Europe-hosted External ID customer tenant when the subscription’s workforce tenant already has the ARM EU data boundary enabled?

Is there a documented exception, alternative provisioning route, or configuration prerequisite that resolves this geographic-location versus Azure-region conflict?

Has anyone successfully created an External ID tenant under this specific ARM EU boundary configuration?

I would particularly appreciate a working example or documentation addressing this boundary restriction, rather than an Azure Policy “Allowed locations” restriction.

Relevant documentation:

• Create an external tenant
• Configure the ARM data boundary