An organization is deploying a public-facing web application hosted on Azure for its retail customers. The organization wants external consumers to register and sign in using their existing social accounts (such as Google or Apple) or an email one-time passcode without requiring internal IT staff to manage customer credentials. Which Microsoft Entra feature should the organization configure to deliver this self-service sign-up experience while enforcing security controls such as Multifactor Authentication (MFA)?

Microsoft Entra External ID user flows integrated with Conditional Access: ### What Microsoft Entra External ID User Flows Are **Microsoft Entra External ID** provides customer identity and access management (**CIAM**) capabilities that allow organizations to externalize authentication for customer-facing web and mobile applications. **User flows** define the specific automated steps that external users take during registration and sign-in, including self-service sign-up, brand customization, and identity provider selection. ### How It Meets the Requirements - **Social and External Identity Federation**: External ID allows users to sign in using their preferred identity providers, including **Google**, **Apple**, **Facebook**, or **email one-time passcodes**, removing the need to manage external credentials manually. - **Self-Service Onboarding**: User flows automate the customer registration and profile management process without intervention from IT administrators or help desk staff. - **Built-in Security Enforcement**: External ID integrates directly with **Conditional Access** and **Microsoft Entra Multifactor Authentication (MFA)**, enabling automated enforcement of MFA based on specific sign-in risks or target application requirements. ### Key Advantages - **Seamless User Experience**: Enables branded sign-up and sign-in pages tailored to languages and platform requirements. - **Centralized Security**: Extends enterprise-grade protections like **Conditional Access** and risk-based policies to customer applications. - **Reduced Management Overhead**: Customers manage their own passwords, MFA enrollment, and profile updates independently. - **Extensibility**: Supports custom authentication extensions to collect attributes and inject external business logic into authentication tokens. ### Why This Is Optimal Integrating **External ID user flows** with **Conditional Access** is the standard, native cloud identity solution designed specifically for customer applications. It delivers a modern self-service experience while maintaining enterprise security standards.