External Identities
B2B collaboration · External ID (CIAM) · Azure AD B2C status
Practice questions for this topic →
Which external identity solution?
| Scenario | Solution |
|---|---|
| Partners and vendors access your apps, Teams, SharePoint | Entra External ID B2B collaboration (guests in the workforce tenant) |
| Customer-facing app sign-up and sign-in, social logins, branding | Entra External ID in an external tenant |
| Existing Azure AD B2C tenant | Keep running or migrate to External ID |
| Tenants inside one organization | Cross-tenant synchronization / multitenant organization |
Azure AD B2C status and migration
| Item | Detail |
|---|---|
| Availability | Not available to new customers since May 1, 2025; existing customers continue, supported until at least May 2030 |
| B2C P2 | Discontinued March 15, 2026; new tenants use P1 |
| Custom policies (IEF) | Map to External ID custom authentication extensions |
| Mobile browser flows | Map to native authentication SDKs (local accounts only) |
| Tenant type | B2C is a separate tenant; you must be signed in to a B2C directory as Global Administrator to use it |
B2B in one line
- External users authenticate to their home directory; your directory holds a representation (guest) that you can assign access to. Entitlement management uses B2B to let partners self-request access.
Exam Tips
Tick each tip once you can answer it without looking.
“New consumer app needs self-service sign-up with Google/Facebook” → Microsoft Entra External ID (external tenant). Trap: Azure AD B2C isn't sold to new customers.
“Partner employees should use their own corporate credentials” → B2B collaboration.
“Restrict B2B invitations to specific partner domains” → External collaboration settings (allow/deny list) / cross-tenant access settings.
“Trust MFA performed in the partner's tenant” → Cross-tenant access settings: inbound trust MFA.
“Automatically provision users across your company's multiple tenants” → Cross-tenant synchronization.
“Guests must be removed when they no longer need access” → Entitlement management access packages + access reviews.
“Azure AD B2C support horizon” → Existing customers supported until at least May 2030; not sold to new customers since May 1, 2025. Trap: B2C P2 was discontinued March 15, 2026.
“B2C custom policies for claims and business logic” → Move to External ID custom authentication extensions. Trap: Mobile browser flows map to native authentication SDKs (local accounts only).