Microsoft Entra External ID - Simply Explained
Microsoft Entra External ID is Microsoft's identity and access management solution for people outside your organization. It enables secure authentication and authorization for business partners, guest users, customers, and consumer applications while supporting modern identity experiences, strong security, and seamless collaboration. Whether you're building customer-facing applications or enabling secure B2B collaboration, External ID provides a scalable platform for managing external identities.
In this episode of Microsoft Knowledge Nuggets, Mirko Peters explains Microsoft Entra External ID in simple terms and shows how it helps organizations securely manage external users. You'll learn the difference between B2B collaboration and Customer Identity and Access Management (CIAM), how external tenants work, and how users can sign in using Microsoft accounts, social identities like Google or Facebook, email one-time passcodes, or other supported identity providers.
The episode also explores common real-world scenarios, including inviting guest users into Microsoft 365, building customer portals, enabling secure partner collaboration, creating branded sign-in experiences, implementing self-service registration, and applying Conditional Access, Multi-Factor Authentication, and lifecycle management for external users. You'll discover how External ID integrates with Microsoft Entra ID, Microsoft Graph, Microsoft Teams, and custom applications while maintaining enterprise-grade security and compliance.
Whether you're an IT administrator, identity architect, developer, security professional, or preparing for Microsoft certification exams, this episode provides a practical introduction to Microsoft Entra External ID. By the end, you'll understand how to securely manage external identities, simplify customer and partner access, protect applications from identity threats, and deliver seamless authentication experiences without compromising security.
In today's digital landscape, managing external user identities poses significant challenges. Organizations need effective solutions to ensure security while providing seamless access to their services. Microsoft Entra External ID emerges as a powerful tool in this realm. It simplifies identity management, allowing you to focus on enhancing user experiences. With its robust features and modern approach, you can confidently navigate the complexities of customer identity and access management.
Key Takeaways
- Microsoft Entra External ID simplifies identity management for external users, enhancing security and user experience.
- The platform supports various authentication methods, allowing users to sign in easily with options like social accounts and email passcodes.
- Customizable user journeys let organizations tailor sign-up and sign-in processes to match their brand identity.
- Robust security features protect sensitive data, including bot protection and multi-factor authentication.
- Automated account management streamlines user lifecycle processes, ensuring compliance and security.
- Integration with existing systems is seamless, making it easier for organizations to manage external identities.
- Microsoft Entra External ID supports compliance with regulations like GDPR and CCPA, enhancing trust with users.
- Organizations can leverage Microsoft Entra External ID for various use cases, including customer identity management and B2B collaboration.
Overview of Microsoft Entra External ID
Microsoft Entra External ID is a powerful solution designed to help organizations manage identities for external users. This platform ensures secure authentication and authorization to applications and APIs through modern identity standards and centralized policy controls. By providing a streamlined approach to identity management, Microsoft Entra External ID allows you to focus on enhancing user experiences while maintaining security.
Key Features
The relevance of Microsoft Entra External ID in identity management stems from its comprehensive set of features. Here are some of the core functionalities that make it stand out:
- Manage External Identities: You can create and manage an external identity directory, allowing for efficient organization of user data.
- User Authentication: The platform enables external users to sign up and sign in easily, enhancing user engagement.
- Integration with Identity Providers: Microsoft Entra External ID supports various authentication methods, including local accounts, email one-time passcodes, and social providers like Facebook and Google.
- Token Issuance: It issues standards-based tokens (OIDC/OAuth2) to applications and APIs, ensuring secure access.
- Custom User Journeys: You can customize user flows and advanced policy configurations to meet specific organizational needs.
- Security Controls: The platform applies robust security measures and monitors sign-in activity with logs and reporting.
Additionally, Microsoft Entra External ID addresses challenges in identity management for external users by offering a modern approach to authentication. It integrates seamlessly with various identity providers, allowing users to choose their preferred login options. This flexibility enhances user satisfaction and compliance with regulations like GDPR and CCPA.
The platform also supports lifecycle management, automating the creation, updating, and deletion of user identities and permissions. This feature ensures that your organization maintains compliance and improves overall security.
Functionality of Microsoft Entra External ID
User Experience
Microsoft Entra External ID offers a seamless integration with existing systems, making it easier for organizations to manage external identities. You can implement a phased strategy for integrating third-party multi-factor authentication (MFA) with Entra ID. Start with a pilot program to minimize disruption. Conduct a thorough needs analysis to identify specific MFA requirements and compliance needs. Choose a solution provider that ensures seamless integration with Entra ID and supports various authentication methods.
The user experience with Microsoft Entra External ID is designed to be intuitive and efficient. Recent surveys show that users appreciate the convenience of creating accounts, applying licenses, and monitoring sign-ups. Here’s a summary of user feedback:
| User Experience Description | Performance Rating |
|---|---|
| Users find Microsoft Entra External ID convenient for user creation, license application, and monitoring sign-ups. | Performing well |
| Integration with applications is seamless, allowing AD users to connect easily. | Positive feedback |
| The on-premise part is easier for some users, indicating a preference for traditional setups. | Mixed feelings |
| Users have successfully integrated external collaborators into their domain. | Successful integration |
| The use of various solutions indicates adaptability based on project requirements. | Flexible usage |
Accessibility features enhance the overall experience. The platform supports modern authentication standards, ensuring that users can sign in using their preferred methods. This flexibility not only improves user satisfaction but also helps organizations comply with regulations like GDPR and CCPA.
Moreover, Microsoft Entra External ID allows you to customize user journeys. You can tailor the sign-up and sign-in processes to reflect your brand identity. This customization includes configuring logos, colors, and styles, which helps create a cohesive experience for your users.
Benefits of Microsoft Entra External ID
Enhanced Security
Microsoft Entra External ID offers robust security measures to protect user data. You can trust that your organization’s sensitive information remains secure with the following features:
- Bot Protection: This feature defends against automated attacks, including identity-related security flaws (IRSF).
- Reputation Email Filtering: It validates email domains to reduce the risk of fraudulent accounts.
- IP Email Filtering: This restricts sign-ups from untrusted IP addresses, enhancing security.
- Excessive OTP Monitoring: You receive alerts for high volumes of one-time password requests from the same source.
- Sign-up Protection: The platform integrates with fraud protection providers to block bot-driven sign-ups.
- CAPTCHA for MFA: This feature distinguishes human users from bots during SMS verification.
- Conditional Access Policies: You can customize these policies to enhance security and reduce risks of compromise.
- Tenant Isolation: This prevents data leakage and ensures resource access isolation across tenants.
- Encryption in Transit: It secures data during transmission between data centers.
These security protocols create a strong defense against common threats. The table below summarizes how Microsoft Entra External ID mitigates risks associated with external identity access:
| Security Layer | Purpose |
|---|---|
| Front-door protection | Protects against common threats like bot attacks and unauthorized access. |
| Identity security | Implements MFA and access controls to secure user identities. |
| Fraud prevention | Detects and prevents fraudulent sign-ups and sign-ins. |
| Application-level authorization | Ensures that only authorized users can access specific applications. |
| Monitoring and alerting | Provides real-time alerts to detect and respond to suspicious activities. |
Streamlined identity management through Microsoft Entra External ID offers several advantages over traditional methods. Here’s a comparison of the benefits:
| Advantage | Description |
|---|---|
| Deep Microsoft Ecosystem Integration | Native compatibility with Microsoft 365, Azure, and Windows environments eliminates integration complexity. |
| AI-Powered Security | Machine learning algorithms provide intelligent threat detection and automated risk remediation. |
| Comprehensive Governance | Built-in access reviews, privileged identity management, and compliance reporting streamline regulatory requirements. |
| Scalable Automation | Handles enterprise-scale identity management with automated provisioning and lifecycle workflows. |
| Extensive Third-Party Support | Integrates with thousands of SaaS applications through pre-built connectors and standard protocols. |
| Enhanced Security Features | Advanced capabilities such as Multi-Factor Authentication (MFA), Conditional Access policies, and Identity Protection safeguard against unauthorized access. |
| Seamless Integration with SaaS Apps | Facilitates Single Sign-On (SSO) and automated provisioning for a wide range of SaaS applications, streamlining user access across platforms. |
With these features, Microsoft Entra External ID not only enhances security but also simplifies the management of external identities. You can focus on delivering a better user experience while ensuring that your organization remains secure.
Use Cases for Microsoft Entra External ID
Customer Identity Management
Microsoft Entra External ID serves various use cases, making it a versatile solution for organizations. One of the primary applications is Customer Identity and Access Management (CIAM). This approach allows you to manage customer identities effectively while ensuring security and compliance.
Here are some key use cases for CIAM:
| Use Case | Description |
|---|---|
| Delegation of Access Management | Centralized IT can delegate access management to business teams, easing management burdens. |
| Customer Access Auditability | Provides full retention of access management events, allowing tracking of customer access history. |
| Customer Lifecycle Management | Ensures proper handling of customer access when subscriptions are canceled or information is removed. |
| Enhanced Security | Isolates customer data from employee data, reducing risks of data breaches. |
| Scalability | Efficiently manages millions of customer identities and transactions. |
| Improved Customer Experience | Facilitates frictionless interactions like single sign-on and social logins. |
Organizations across various sectors can benefit from these capabilities. For example, universities can create portals for alumni and prospective students. They allow sign-in with social identities or one-time passcodes, simplifying access without needing an internal account.
Manufacturers also leverage Microsoft Entra External ID for secure access to supplier portals. They can implement federated login support for large partners and apply Conditional Access for compliant devices. This ensures that only authorized users can access sensitive information.
SaaS providers integrate Microsoft Entra External ID into their applications. This integration enables business customers to register new users and manage access efficiently. By focusing on product features rather than security infrastructure, these companies can enhance their offerings.
Business-to-Business (B2B) Collaboration
Microsoft Entra External ID excels in B2B identity scenarios. It supports user flows that define various sign-in methods and external identity providers. Here are some key features:
- Microsoft Entra ID federation enables seamless B2B collaboration.
- Business partners can onboard via Entitlement Management, self-service sign-up, or invitations.
- Cross-tenant synchronization and access settings are available for multi-tenant scenarios.
These features simplify the management of B2B relationships, allowing organizations to collaborate more effectively.
Machine-to-Machine (M2M) Communication
In addition to CIAM and B2B, Microsoft Entra External ID supports machine-to-machine (M2M) communication. This capability allows secure authentication through the OAuth 2.0 client credentials flow. One machine can authenticate itself and obtain an access token to interact with APIs or trigger processes without human intervention.
For example, backend services can communicate with payment processors or internal microservices. Microsoft Entra External ID enables these services to authenticate using a client ID and secret, ensuring secure API calls. This design allows applications to communicate directly without human involvement, streamlining operations.
By implementing Microsoft Entra External ID, organizations can enhance their identity management capabilities across various scenarios, ensuring security and efficiency.
Importance of Microsoft Entra External ID
In today's rapidly evolving digital landscape, managing identities effectively is crucial. Microsoft Entra External ID plays a significant role in modern identity management. It provides organizations with the tools they need to secure user identities while ensuring seamless access to applications and services. By centralizing identity management, you can enhance security and improve user experiences.
Here are some key reasons why Microsoft Entra External ID is essential:
- Unified Identity Management: You can manage identities across both cloud and on-premises environments. This ensures consistent security controls, which is vital for protecting sensitive data.
- Automated Account Management: The platform automates account management for guest users. This feature allows secure access without requiring additional passwords, simplifying the user experience.
- Enhanced Security Measures: Microsoft Entra External ID integrates multifactor authentication policies for guest users. This integration strengthens security during application proxy authentication, reducing the risk of unauthorized access.
As you look to the future, several trends in identity security will shape how organizations approach identity management. Here’s a summary of predicted trends relevant to Microsoft Entra External ID:
| Trend Description | Implication for Microsoft Entra External ID |
|---|---|
| Shift towards integrated identity security solutions | Microsoft Entra is positioned to support a Zero Trust architecture, enhancing security across platforms. |
| Emphasis on vendor neutrality | Microsoft aims to strengthen security capabilities through comprehensive solutions that integrate with various third parties. |
| Bundling of cybersecurity offerings | Organizations may increasingly rely on platforms like Microsoft Entra for identity management, reducing complexity and vendor count. |
These trends indicate a growing need for comprehensive identity solutions. As organizations face increasing security threats, they will seek platforms that offer robust identity management capabilities. Microsoft Entra External ID is well-equipped to meet these demands, ensuring that you can manage identities securely and efficiently.
By adopting Microsoft Entra External ID, you position your organization to thrive in an environment where identity security is paramount. The platform not only addresses current challenges but also prepares you for future developments in identity management.
Microsoft Entra External ID significantly impacts enterprise identity management. It enhances security by providing a robust framework for managing external identities. This solution streamlines user experiences, making it easier for organizations to manage access. Here are some key takeaways:
- Enhances security: Protects sensitive data through advanced security measures.
- Streamlines user experiences: Simplifies identity management for better engagement.
- Optimizes authentication: Choosing the right methods can improve efficiency.
To maximize the benefits of Microsoft Entra External ID, consider these recommendations:
| Recommendation | Description |
|---|---|
| Utilize Entra ID Protection Dashboard | Leverage tailored security recommendations based on recent attacks. |
| Implement Passwordless Authentication | Reduce risks associated with password attacks and enhance user experience. |
| Disable Legacy Authentication | Strengthen security across the organization by turning off outdated methods. |
By adopting these strategies, you can enhance your security posture and ensure effective identity management.
FAQ
What is Microsoft Entra External ID?
Microsoft Entra External ID is a Customer Identity and Access Management (CIAM) platform. It helps organizations manage external user identities securely and efficiently.
How does Microsoft Entra External ID enhance security?
The platform offers advanced security features like multi-factor authentication, conditional access policies, and bot protection. These measures safeguard user data and prevent unauthorized access.
Can I customize user experiences with Microsoft Entra External ID?
Yes! You can tailor sign-up and sign-in processes to reflect your brand. Customize logos, colors, and styles to create a cohesive user experience.
What types of organizations benefit from Microsoft Entra External ID?
Organizations across various sectors, including universities, manufacturers, and SaaS providers, can benefit. They can streamline identity management and enhance user access.
How does Microsoft Entra External ID support compliance?
The platform helps organizations comply with regulations like GDPR and CCPA. It provides features for managing user consent and data protection.
Is Microsoft Entra External ID easy to integrate with existing systems?
Absolutely! Microsoft Entra External ID integrates seamlessly with various applications and identity providers. This flexibility simplifies the management of external identities.
What are the primary use cases for Microsoft Entra External ID?
The main use cases include Customer Identity and Access Management (CIAM), Business-to-Business (B2B) collaboration, and Machine-to-Machine (M2M) communication.
How can I get started with Microsoft Entra External ID?
To get started, visit the Microsoft Entra website. You can explore documentation, tutorials, and resources to help you implement the platform effectively.
🚀 Want to be part of m365.fm?
Then stop just listening… and start showing up.
👉 Connect with me on LinkedIn and let’s make something happen:
- 🎙️ Be a podcast guest and share your story
- 🎧 Host your own episode (yes, seriously)
- 💡 Pitch topics the community actually wants to hear
- 🌍 Build your personal brand in the Microsoft 365 space
This isn’t just a podcast — it’s a platform for people who take action.
🔥 Most people wait. The best ones don’t.
👉 Connect with me on LinkedIn and send me a message:
"I want in"
Let’s build something awesome 👊
1
00:00:00,000 --> 00:00:03,340
Actually, most people think identity is just a user name and password.
2
00:00:03,340 --> 00:00:05,320
You type it in, you get access and done.
3
00:00:05,320 --> 00:00:09,200
But when you're a business serving customers, identity gets way more complicated.
4
00:00:09,200 --> 00:00:12,080
What happens when your app needs to let thousands of people sign up?
5
00:00:12,080 --> 00:00:15,760
Or let them sign in with their Google account instead of creating yet another password?
6
00:00:15,760 --> 00:00:20,400
And how do you keep all that customer data safe without mixing it up with your employee directory?
7
00:00:20,400 --> 00:00:23,720
That's exactly the problem Microsoft Entra external ID was built to solve.
8
00:00:23,720 --> 00:00:27,200
Here's the thing, it's replacing Azure ADB to see entirely.
9
00:00:27,200 --> 00:00:30,440
By the end of this episode, you'll understand what external ID actually is,
10
00:00:30,440 --> 00:00:35,280
the three main ways you'd use it and why it matters for any customer facing app.
11
00:00:35,280 --> 00:00:38,040
The old way, separate identity silos.
12
00:00:38,040 --> 00:00:41,120
Imagine it's 20 years ago and you've built an app for customers.
13
00:00:41,120 --> 00:00:44,920
Back then, you'd roll your own login system, write the code for passwords,
14
00:00:44,920 --> 00:00:49,080
set up a database to store them, build the forgot password flow, all from scratch.
15
00:00:49,080 --> 00:00:52,600
That worked fine for a small app with a few hundred users, but as apps grew,
16
00:00:52,600 --> 00:00:54,120
things got complicated fast.
17
00:00:54,120 --> 00:00:58,800
The companies needed to let users sign in with Google or Facebook, they needed multi factor authentication,
18
00:00:58,800 --> 00:01:01,640
and they needed to handle millions of accounts without breaking.
19
00:01:01,640 --> 00:01:04,120
Building all that yourself, it became a nightmare.
20
00:01:04,120 --> 00:01:06,880
Microsoft's first answer was Azure ADB to see.
21
00:01:06,880 --> 00:01:10,560
It was a customer identity service and at the time it solved a real problem.
22
00:01:10,560 --> 00:01:12,120
But here's where the pain started.
23
00:01:12,120 --> 00:01:17,120
The biggest issue was something called custom policies and those policies were written in XML.
24
00:01:17,120 --> 00:01:20,200
If you've ever worked with XML files that span hundreds of lines,
25
00:01:20,200 --> 00:01:22,080
you know exactly how painful that is.
26
00:01:22,080 --> 00:01:26,360
Hard to configure, hard to debug and when something broke, good luck figuring out why.
27
00:01:26,360 --> 00:01:30,440
On top of that, Azure ADB to see was separate from Microsoft's main identity platform.
28
00:01:30,440 --> 00:01:35,040
So if you already had Microsoft 365 or Azure AD for your employees,
29
00:01:35,040 --> 00:01:37,760
B2C felt like learning a completely new product.
30
00:01:37,760 --> 00:01:40,280
As you'd expect, IT teams struggled to maintain it,
31
00:01:40,280 --> 00:01:44,400
developers dreaded working with it, and customers ended up with a clunky signup experience
32
00:01:44,400 --> 00:01:45,880
that made them want to leave.
33
00:01:45,880 --> 00:01:49,040
Microsoft realized they needed something simpler and more unified.
34
00:01:49,040 --> 00:01:51,960
And that's exactly what became Microsoft's internal ID.
35
00:01:51,960 --> 00:01:54,600
What Microsoft's internal ID actually is.
36
00:01:54,600 --> 00:01:57,120
So what exactly is Microsoft's internal ID?
37
00:01:57,120 --> 00:01:58,400
Here's the simplest definition.
38
00:01:58,400 --> 00:02:03,080
It's a cloud identity service for external users, customers, partners and guests.
39
00:02:03,080 --> 00:02:03,880
Not employees.
40
00:02:03,880 --> 00:02:04,920
Think of it this way.
41
00:02:04,920 --> 00:02:06,720
Imagine your company has an office building.
42
00:02:06,720 --> 00:02:07,920
That's your workforce tenant.
43
00:02:07,920 --> 00:02:11,720
It's where your employees work, where their desks are, where their badges let them in.
44
00:02:11,720 --> 00:02:13,480
EntraID manages that building.
45
00:02:13,480 --> 00:02:16,120
Now imagine you're opening a storefront for customers.
46
00:02:16,120 --> 00:02:17,000
A separate space.
47
00:02:17,000 --> 00:02:19,320
Its own entrance, its own rules, its own security.
48
00:02:19,320 --> 00:02:21,880
Customers don't wander into the employee break room.
49
00:02:21,880 --> 00:02:24,520
And employees don't accidentally access customer accounts.
50
00:02:24,520 --> 00:02:25,800
That's external ID.
51
00:02:25,800 --> 00:02:28,920
It's part of the Microsoft Entra family, but a different flavor.
52
00:02:28,920 --> 00:02:32,320
It's built for CM, customer identity and access management.
53
00:02:32,320 --> 00:02:35,720
And it handles the whole life cycle of an external user.
54
00:02:35,720 --> 00:02:40,240
Sign up, sign in, password reset, profile management, MFA, token issuance.
55
00:02:40,240 --> 00:02:43,920
It works with standard protocols like OAuth 2.0, open ID connect and
56
00:02:43,920 --> 00:02:44,520
SAML.
57
00:02:44,520 --> 00:02:46,480
So almost any app you build can connect.
58
00:02:46,480 --> 00:02:50,680
But here's the big difference from the old Azure ADB2C external ID is simpler.
59
00:02:50,680 --> 00:02:52,320
No more custom XML policies.
60
00:02:52,320 --> 00:02:55,520
Instead you configure user flows directly in the admin center.
61
00:02:55,520 --> 00:03:00,040
Or you use custom authentication extensions that hook into your existing backend logic.
62
00:03:00,040 --> 00:03:02,000
Same power, less headache.
63
00:03:02,000 --> 00:03:03,800
The three core use cases.
64
00:03:03,800 --> 00:03:05,720
So how do you actually use external ID?
65
00:03:05,720 --> 00:03:06,920
There are three main scenarios.
66
00:03:06,920 --> 00:03:11,280
They cover almost every situation where you need to manage someone who isn't an employee.
67
00:03:11,280 --> 00:03:14,960
Start with the most common one, customer identity or B2C.
68
00:03:14,960 --> 00:03:17,080
Imagine you're building a pizza ordering app.
69
00:03:17,080 --> 00:03:20,640
You need people to sign up, place orders and come back next week.
70
00:03:20,640 --> 00:03:24,400
You want them to sign in with their Google account instead of creating another password.
71
00:03:24,400 --> 00:03:27,680
And you need to collect their name, phone number and delivery preferences.
72
00:03:27,680 --> 00:03:29,160
External ID handles all of that.
73
00:03:29,160 --> 00:03:31,560
You get pre-built sign up and sign in flows.
74
00:03:31,560 --> 00:03:33,800
You configure which attributes to collect.
75
00:03:33,800 --> 00:03:36,160
Name, phone, whatever you need.
76
00:03:36,160 --> 00:03:40,040
You set up social sign in with Google, Facebook or Apple.
77
00:03:40,040 --> 00:03:44,360
And when a user authenticates, external ID issues a token to your app so
78
00:03:44,360 --> 00:03:46,120
it knows who that person is.
79
00:03:46,120 --> 00:03:48,480
This is the replacement for Azure ADB2C.
80
00:03:48,480 --> 00:03:50,360
And it's where most organizations start.
81
00:03:50,360 --> 00:03:53,640
The scenario is business to business collaboration or B2B.
82
00:03:53,640 --> 00:03:57,880
This is when you need to give partners or vendors access to your internal apps.
83
00:03:57,880 --> 00:04:02,440
Maybe you have a share point site that your external logistics partner needs to see.
84
00:04:02,440 --> 00:04:05,320
Or a project management tool that your freelance designers use.
85
00:04:05,320 --> 00:04:09,200
In this scenario, you invite them as guest users in your workforce tenant.
86
00:04:09,200 --> 00:04:13,840
External ID handles the invitation email, the redemption process where they accept the invite,
87
00:04:13,840 --> 00:04:16,400
and the access policies that control what they can see.
88
00:04:16,400 --> 00:04:21,320
This has actually been around for years as B2B collaboration inside Azure AD.
89
00:04:21,320 --> 00:04:24,720
But now it's part of the external ID umbrella so you manage it from the same place as your
90
00:04:24,720 --> 00:04:26,320
customer identities.
91
00:04:26,320 --> 00:04:28,480
Then there's machine to machine or M2M.
92
00:04:28,480 --> 00:04:31,400
This one is less visible to end users but just as important.
93
00:04:31,400 --> 00:04:35,800
Sometimes your backend service needs to talk to another API, a payment processor, a data
94
00:04:35,800 --> 00:04:38,160
analytic service or an internal microservice.
95
00:04:38,160 --> 00:04:39,200
There's no human involved.
96
00:04:39,200 --> 00:04:41,520
It's just one application calling another.
97
00:04:41,520 --> 00:04:45,240
External ID uses the OAuth 2.0 client credentials flow.
98
00:04:45,240 --> 00:04:49,360
Your service authenticates itself using a client ID and a secret and it gets a token to call
99
00:04:49,360 --> 00:04:50,960
the downstream API.
100
00:04:50,960 --> 00:04:54,160
This requires the M2M premium add-on so there's a cost factor.
101
00:04:54,160 --> 00:04:57,840
But if you need to secure API to API communication, it's built right in.
102
00:04:57,840 --> 00:05:02,600
Now these three scenarios cover almost every external identity situation you'll run into.
103
00:05:02,600 --> 00:05:06,440
But there's a big decision you need to make and that's where those users actually live.
104
00:05:06,440 --> 00:05:09,560
Because external ID can run in two very different places.
105
00:05:09,560 --> 00:05:11,640
Workforce tenant versus external tenant.
106
00:05:11,640 --> 00:05:15,280
Just break down the two options external ID can run inside your existing workforce tenant
107
00:05:15,280 --> 00:05:17,680
or it can run as a completely separate external tenant.
108
00:05:17,680 --> 00:05:21,640
They are not the same thing and picking the wrong one can cause problems down the road.
109
00:05:21,640 --> 00:05:23,280
Start with the workforce tenant option.
110
00:05:23,280 --> 00:05:26,360
Your company already has an enter ID tenant for your employees.
111
00:05:26,360 --> 00:05:27,760
That's your workforce tenant.
112
00:05:27,760 --> 00:05:32,400
If you enable a feature called guest/self-service signup inside that tenant, external users can
113
00:05:32,400 --> 00:05:35,160
sign up and land in the same directory as your employees.
114
00:05:35,160 --> 00:05:37,720
They are accounts set right next to your CEO's account.
115
00:05:37,720 --> 00:05:42,160
Your simpler B2B scenarios like inviting a handful of partners to a sharepoint site, mixing
116
00:05:42,160 --> 00:05:44,320
them in the same directory is perfectly fine.
117
00:05:44,320 --> 00:05:47,240
It's simple to set up and you don't need to manage a separate tenant.
118
00:05:47,240 --> 00:05:48,240
But here's the thing.
119
00:05:48,240 --> 00:05:51,560
If you're building a customer facing app with thousands of users, you don't want those
120
00:05:51,560 --> 00:05:54,600
customers living in the same directory as your employees.
121
00:05:54,600 --> 00:05:55,600
That's a security risk.
122
00:05:55,600 --> 00:05:58,080
An employee could accidentally stumble into customer data.
123
00:05:58,080 --> 00:06:01,840
A configuration change meant for employees could affect customer access.
124
00:06:01,840 --> 00:06:05,280
And your branding for customer sign in pages would be tied to whatever you've set up for
125
00:06:05,280 --> 00:06:06,280
your company.
126
00:06:06,280 --> 00:06:07,280
That's not ideal.
127
00:06:07,280 --> 00:06:09,120
The alternative is the external tenant option.
128
00:06:09,120 --> 00:06:13,040
You create a brand new isolated directory specifically for customer identities.
129
00:06:13,040 --> 00:06:14,040
No employees live here.
130
00:06:14,040 --> 00:06:15,400
It's a completely separate space.
131
00:06:15,400 --> 00:06:17,400
Remember the office building analogy from earlier?
132
00:06:17,400 --> 00:06:19,560
The workforce tenant is your corporate headquarters.
133
00:06:19,560 --> 00:06:23,280
The external tenant is the dedicated storefront you open for your customers.
134
00:06:23,280 --> 00:06:27,200
They have their own entrance, their own rules, and their own security.
135
00:06:27,200 --> 00:06:28,200
Nothing gets mixed up.
136
00:06:28,200 --> 00:06:30,400
So what are the benefits of an external tenant?
137
00:06:30,400 --> 00:06:33,080
First you get an isolated user store.
138
00:06:33,080 --> 00:06:37,080
Customer data stays completely separate from employee data, which reduces risk and simplifies
139
00:06:37,080 --> 00:06:38,080
compliance.
140
00:06:38,080 --> 00:06:39,440
Second you get separate branding.
141
00:06:39,440 --> 00:06:43,440
You can customize the look and feel of sign in pages specifically for your customers without
142
00:06:43,440 --> 00:06:45,440
affecting anything in your corporate tenant.
143
00:06:45,440 --> 00:06:49,680
Third you get the native authentication API for mobile apps, which lets you build completely
144
00:06:49,680 --> 00:06:52,600
custom login screens inside your iOS or Android app.
145
00:06:52,600 --> 00:06:55,240
No browser redirects, no clunky web views.
146
00:06:55,240 --> 00:06:58,400
And fourth you get MAU based pricing, monthly active users.
147
00:06:58,400 --> 00:07:03,160
You only pay for the users who actually authenticate in a given month, which scales naturally with
148
00:07:03,160 --> 00:07:04,360
your customer growth.
149
00:07:04,360 --> 00:07:05,720
So when do you choose which?
150
00:07:05,720 --> 00:07:09,440
It's pretty straightforward if you're building a B2C app with thousands of customers, go
151
00:07:09,440 --> 00:07:10,920
with an external tenant.
152
00:07:10,920 --> 00:07:14,200
That's the recommended approach, and it's what external ID was designed for.
153
00:07:14,200 --> 00:07:18,080
If you're just inviting a few partners to access internal resources, the workforce tenant
154
00:07:18,080 --> 00:07:19,080
option is fine.
155
00:07:19,080 --> 00:07:22,880
The key is understanding the difference before you start building, because migrating from
156
00:07:22,880 --> 00:07:25,640
one to the other later is not trivial.
157
00:07:25,640 --> 00:07:28,040
Security, MFA, and conditional access.
158
00:07:28,040 --> 00:07:29,800
Now let's talk about security.
159
00:07:29,800 --> 00:07:33,200
If you're going to let customers into your app, you need to make sure the wrong people
160
00:07:33,200 --> 00:07:34,520
don't get in.
161
00:07:34,520 --> 00:07:38,600
Internal ID includes the same enterprise grade security features that intra ID offers for
162
00:07:38,600 --> 00:07:39,640
employees.
163
00:07:39,640 --> 00:07:44,360
That means multi-factor authentication, conditional access, and risk-based policies.
164
00:07:44,360 --> 00:07:46,920
For MFA, you've got two options right now.
165
00:07:46,920 --> 00:07:48,440
Email one-time passcode is free.
166
00:07:48,440 --> 00:07:51,760
The system sends a code to the user's email, they type it in, done.
167
00:07:51,760 --> 00:07:55,480
SMS one-time passcode works the same way it goes to their phone and there are carrier costs
168
00:07:55,480 --> 00:07:56,480
involved.
169
00:07:56,480 --> 00:07:59,400
One thing to note, there's no Microsoft Authenticator support yet.
170
00:07:59,400 --> 00:08:02,840
That's a current limitation, and it's something Microsoft is likely working on, but for
171
00:08:02,840 --> 00:08:05,000
now, it's email or SMS.
172
00:08:05,000 --> 00:08:07,040
Conditional access is where things get interesting.
173
00:08:07,040 --> 00:08:11,640
You can define rules that say things like require MFA when the sign-in-risk is medium or higher
174
00:08:11,640 --> 00:08:14,920
or block access from countries we don't do business in.
175
00:08:14,920 --> 00:08:18,120
The system evaluates each login attempt in real time.
176
00:08:18,120 --> 00:08:23,160
If someone tries to sign in from a location or device that looks suspicious, it can automatically
177
00:08:23,160 --> 00:08:27,560
step up the security requirements without you having to build any of that logic yourself.
178
00:08:27,560 --> 00:08:30,640
But there's one feature that really stands out, step-up authentication.
179
00:08:30,640 --> 00:08:31,640
Here's how it works.
180
00:08:31,640 --> 00:08:35,600
The user logs into your app with just a password to browse your product catalog.
181
00:08:35,600 --> 00:08:37,360
That's fine for low-risk activities.
182
00:08:37,360 --> 00:08:41,320
But when they try to view their payment history or download an invoice, you want additional
183
00:08:41,320 --> 00:08:42,560
verification.
184
00:08:42,560 --> 00:08:46,760
With step-up authentication, you can require MFA only for specific sections of your app.
185
00:08:46,760 --> 00:08:50,080
The user doesn't get prompted until they try to access something sensitive.
186
00:08:50,080 --> 00:08:54,320
And it's all handled by external ID behind the scenes using something called authentication
187
00:08:54,320 --> 00:08:55,320
context.
188
00:08:55,320 --> 00:08:59,040
You define which parts of your app need extra security and the system takes care of the
189
00:08:59,040 --> 00:09:00,040
rest.
190
00:09:00,040 --> 00:09:05,360
The user gets a smooth experience for basic browsing, but the sensitive data stays protected.
191
00:09:05,360 --> 00:09:06,880
Branding and user experience.
192
00:09:06,880 --> 00:09:10,920
Branding control is one of the biggest reasons organizations go with external ID instead of
193
00:09:10,920 --> 00:09:12,720
building their own login system.
194
00:09:12,720 --> 00:09:16,440
You get full control over the look and feel of your sign-up and sign-in pages, upload your
195
00:09:16,440 --> 00:09:20,720
logo, set background colors, add a fabric on for the browser tab, and customize the header
196
00:09:20,720 --> 00:09:24,120
and footer with links to your privacy policy and terms of service.
197
00:09:24,120 --> 00:09:28,160
If you want even more control, you can upload a custom CSS file to override fonts, button
198
00:09:28,160 --> 00:09:29,160
colors and layout.
199
00:09:29,160 --> 00:09:32,000
It's your brand, your colors, everything you decide.
200
00:09:32,000 --> 00:09:34,080
Now here's where things get a bit tricky.
201
00:09:34,080 --> 00:09:36,480
Branding is global, pertinent, not per application.
202
00:09:36,480 --> 00:09:41,000
So if you have multiple apps, say a customer portal and a mobile app, they all share the same
203
00:09:41,000 --> 00:09:42,320
branded pages.
204
00:09:42,320 --> 00:09:47,440
You can't give each app its own look, the old Azure ADB2C let you do per application branding,
205
00:09:47,440 --> 00:09:49,720
but external ID doesn't support that yet.
206
00:09:49,720 --> 00:09:53,080
Another limitation, error messages on login pages are not customizable.
207
00:09:53,080 --> 00:09:56,560
If someone types an email that doesn't exist, they'll see something like, we couldn't
208
00:09:56,560 --> 00:09:59,640
find an account with this email address and you cannot change that text.
209
00:09:59,640 --> 00:10:03,880
For some organizations that's fine, but for others, especially those in regulated industries
210
00:10:03,880 --> 00:10:06,880
over the strict brand voice, it's a real problem.
211
00:10:06,880 --> 00:10:08,280
Mobile apps get a better option.
212
00:10:08,280 --> 00:10:11,960
External ID has a native authentication API for iOS and Android.
213
00:10:11,960 --> 00:10:16,440
Instead of redirecting users to a browser-based login page, you can build fully custom login
214
00:10:16,440 --> 00:10:18,160
screens inside your app.
215
00:10:18,160 --> 00:10:20,480
No browser redirect, no clunky web views.
216
00:10:20,480 --> 00:10:23,840
The user stays in your app the whole time and you control every pixel.
217
00:10:23,840 --> 00:10:29,600
It's a much smoother experience and it's one of those features as your ADB2C never had.
218
00:10:29,600 --> 00:10:31,280
Migration from Azure ADB2C.
219
00:10:31,280 --> 00:10:35,160
If you're already on Azure ADB2C, you're probably wondering what this means for you.
220
00:10:35,160 --> 00:10:39,720
Here's the thing, Microsoft will keep supporting B2C until at least 2030, so your existing
221
00:10:39,720 --> 00:10:41,560
tenants won't stop working tomorrow.
222
00:10:41,560 --> 00:10:43,240
But no new features are coming.
223
00:10:43,240 --> 00:10:48,760
All the innovation, past keys, native authentication, fraud protection is exclusive to external ID.
224
00:10:48,760 --> 00:10:50,840
You're on a platform that's essentially frozen.
225
00:10:50,840 --> 00:10:54,880
Microsoft has published official migration tools and guidance and there are two parts depending
226
00:10:54,880 --> 00:10:55,880
on your scale.
227
00:10:55,880 --> 00:11:00,760
For tenants with fewer than about 5 million directory objects, users, groups, custom attributes,
228
00:11:00,760 --> 00:11:03,240
standard migration is relatively straightforward.
229
00:11:03,240 --> 00:11:05,280
It works like a tenant to tenant move.
230
00:11:05,280 --> 00:11:10,040
You create a new external ID tenant, migrate your users and their credentials, then cut over
231
00:11:10,040 --> 00:11:11,640
your applications.
232
00:11:11,640 --> 00:11:15,760
Microsoft provides tools for bulk user export and import and you can use just in time password
233
00:11:15,760 --> 00:11:19,160
migration to keep disruption low during the transition.
234
00:11:19,160 --> 00:11:23,160
For larger tenants with over 5 million directory objects, there's high scale compatibility mode
235
00:11:23,160 --> 00:11:24,280
or HSC.
236
00:11:24,280 --> 00:11:29,400
In this mode, Azure ADB2C and external ID run side by side in the same tenant.
237
00:11:29,400 --> 00:11:34,200
Your existing B2C endpoints stay active while you gradually move applications over.
238
00:11:34,200 --> 00:11:38,360
It's designed for organizations that can't migrate millions of users overnight, but it comes
239
00:11:38,360 --> 00:11:39,360
with trade-offs.
240
00:11:39,360 --> 00:11:43,640
No social identity providers, no past keys, limited conditional access and some features
241
00:11:43,640 --> 00:11:45,000
simply aren't available.
242
00:11:45,000 --> 00:11:47,360
Think of it as a bridging strategy, not a permanent solution.
243
00:11:47,360 --> 00:11:50,240
Now, a major change, custom policies are gone.
244
00:11:50,240 --> 00:11:55,000
If you've built complex authentication flows using Azure ADB2C's XML based identity experience
245
00:11:55,000 --> 00:11:59,160
framework, those won't work in external ID, you'll have to rebuild that logic using user
246
00:11:59,160 --> 00:12:01,680
flows and custom authentication extensions.
247
00:12:01,680 --> 00:12:04,880
There's no magic tool that converts your XML into the new format.
248
00:12:04,880 --> 00:12:06,280
You just have to do the work.
249
00:12:06,280 --> 00:12:07,600
So here's what it comes down to.
250
00:12:07,600 --> 00:12:10,160
If you're starting fresh today, use external ID.
251
00:12:10,160 --> 00:12:12,280
There's no reason to even look at B2C.
252
00:12:12,280 --> 00:12:15,480
If you have an existing B2C tenant, start planning your migration node.
253
00:12:15,480 --> 00:12:19,360
You've got until 2030, but waiting until the last minute means you'll be rushing through
254
00:12:19,360 --> 00:12:23,080
a complex migration while trying to keep existing apps running.
255
00:12:23,080 --> 00:12:24,080
Start small.
256
00:12:24,080 --> 00:12:28,600
Pick one application, migrate it, test it, learn from the process, then do the rest.
257
00:12:28,600 --> 00:12:30,600
Developer experience and automation.
258
00:12:30,600 --> 00:12:34,960
Microsoft really focused on making external ID easy for developers, and it's a huge change
259
00:12:34,960 --> 00:12:37,320
from the old B2C custom policies.
260
00:12:37,320 --> 00:12:40,680
You know those XML files that stretched for hundreds of lines and broke if you misplaced
261
00:12:40,680 --> 00:12:41,680
a single bracket?
262
00:12:41,680 --> 00:12:42,680
That's gone.
263
00:12:42,680 --> 00:12:46,600
There's a visual studio code extension called Microsoft Entra External ID.
264
00:12:46,600 --> 00:12:50,040
After you authenticate, you can browse your tenant, view user flows, download them as
265
00:12:50,040 --> 00:12:54,520
JSON files, and even preview your branding, all without leaving your editor.
266
00:12:54,520 --> 00:12:57,760
You see what your sign-in page looks like before you ever publish it?
267
00:12:57,760 --> 00:13:00,040
Then there's the Microsoft Graph API.
268
00:13:00,040 --> 00:13:04,520
Almost every external ID resource, user flows, app registrations, branding can be managed
269
00:13:04,520 --> 00:13:05,520
programmatically.
270
00:13:05,520 --> 00:13:09,880
That means you automate tenant setup in your CIR, CD pipelines, using PowerShell or rest
271
00:13:09,880 --> 00:13:14,680
calls, create a new tenant, configure the user flows, register your app, setup branding,
272
00:13:14,680 --> 00:13:15,880
all from a script.
273
00:13:15,880 --> 00:13:19,080
If you manage multiple environments, that saves a ton of time.
274
00:13:19,080 --> 00:13:21,560
Custom authentication extensions are where the real power lives.
275
00:13:21,560 --> 00:13:26,720
Instead of complex XML, you extend authentication flows with simple HTTP calls to add your functions.
276
00:13:26,720 --> 00:13:28,840
There are four events you can hook into.
277
00:13:28,840 --> 00:13:34,160
Token issuance start lets you add custom claims to tokens, like roles or loyalty tier info.
278
00:13:34,160 --> 00:13:38,960
Attribute collection, start, and submit, let you validate or prefill sign-up data by calling
279
00:13:38,960 --> 00:13:40,200
your own backend.
280
00:13:40,200 --> 00:13:43,560
An email OTP sent lets you customize the verification emails.
281
00:13:43,560 --> 00:13:47,200
It's the same flexibility B2C had, but in a model any developer can work with.
282
00:13:47,200 --> 00:13:48,760
There are limitations to know.
283
00:13:48,760 --> 00:13:52,680
No Microsoft Graph notifications yet, so you can't automatically trigger a workflow when
284
00:13:52,680 --> 00:13:54,160
a new user signs up.
285
00:13:54,160 --> 00:13:57,840
Some configurations still need to be done manually in the admin center, and there's no built-in
286
00:13:57,840 --> 00:13:59,160
edit profile page.
287
00:13:59,160 --> 00:14:02,800
If you want users to update their information, you need to build that page in your app and
288
00:14:02,800 --> 00:14:04,520
call the Graph API yourself.
289
00:14:04,520 --> 00:14:06,120
But the direction is clear.
290
00:14:06,120 --> 00:14:08,760
Microsoft wants external ID to be fully automatable.
291
00:14:08,760 --> 00:14:11,080
That makes it easier to manage its scale.
292
00:14:11,080 --> 00:14:16,360
So now you know, Microsoft Entra external ID is the modern replacement for Azure AD B2C
293
00:14:16,360 --> 00:14:18,280
unified under the Entra brand.
294
00:14:18,280 --> 00:14:23,120
The three use cases, custom identity, partner collaboration, and machine to machine.
295
00:14:23,120 --> 00:14:27,160
Cover almost every external identity need you'll run into, and the key decision is whether
296
00:14:27,160 --> 00:14:30,520
to use your workforce tenant or create a separate external tenant.
297
00:14:30,520 --> 00:14:34,120
For customer facing apps, separate is almost always better.
298
00:14:34,120 --> 00:14:35,960
Identity is the front door to your application.
299
00:14:35,960 --> 00:14:42,480
Using it right, secure, branded, and simple directly impacts user trust and business growth.
300
00:14:42,480 --> 00:14:47,120
Your homework, head over to Entra, Microsoft.com, create an external tenant, and try the
301
00:14:47,120 --> 00:14:48,600
get started guide.
302
00:14:48,600 --> 00:14:51,560
It'll walk you through setting up a sample app in minutes.
303
00:14:51,560 --> 00:14:55,000
Subscribe for more plain English breakdowns of Microsoft's identity platform.
Founder of m365.fm, m365.show and m365con.net
Mirko Peters is a Microsoft 365 expert, content creator, and founder of m365.fm, a platform dedicated to sharing practical insights on modern workplace technologies. His work focuses on Microsoft 365 governance, security, collaboration, and real-world implementation strategies.
Through his podcast and written content, Mirko provides hands-on guidance for IT professionals, architects, and business leaders navigating the complexities of Microsoft 365. He is known for translating complex topics into clear, actionable advice, often highlighting common mistakes and overlooked risks in real-world environments.
With a strong emphasis on community contribution and knowledge sharing, Mirko is actively building a platform that connects experts, shares experiences, and helps organizations get the most out of their Microsoft 365 investments.
