Start here! Get your feet wet with the Microsoft cloud and begin your journey to earning your Microsoft Certified: Azure Fundamentals certification!
Gauge your current knowledge
Gauge your current knowledge
Azure AD B2C is a cloud service designed to manage identity and access for customer-facing applications. It acts as an identity management solution that lets customers sign in using their existing social or enterprise accounts. By integrating with external identity providers like Google, Facebook, and Microsoft accounts, the service removes the need for users to create yet another username and password. This integration simplifies the sign-in process and helps businesses accommodate diverse user preferences.
A core benefit of Azure AD B2C is the ability to fully customize how the sign-up and sign-in screens look and feel. Organizations can modify the interface layout, language options, and branding elements to match their company identity. This customization ensures that customers experience a seamless transition from the main application to the login pages, which helps maintain brand loyalty.
To protect customer data, Azure AD B2C includes built-in security features like multi-factor authentication (MFA) and conditional access policies. These tools verify user identities and block unauthorized access to sensitive application data. The service also integrates with other Azure services, which lets developers build a secure, unified cloud environment where user access scales automatically as the customer base grows.
Managing external identities involves configuring how outside users interact with your cloud resources. Through business-to-business (B2B) collaboration, organizations invite guest users from other directories to access resources without creating duplicate accounts. Administrators control this relationship using external user leave settings, which determine if guest users can remove themselves from the tenant. If the admin selects Yes, guests can leave on their own; if set to No, guests are blocked from leaving and must contact a designated privacy administrator instead.
When a guest user leaves a tenant, their account enters a soft deletion state and is moved to the Deleted users container. The account remains in this state for 30 days, during which an administrator can fully restore the user, along with their group memberships and access rights. If the account must be removed immediately for security reasons, administrators can choose to permanently delete it, which triggers an irreversible deletion process that completes within 30 days. For B2B direct connect users, the data removal process begins as soon as the user confirms they are leaving.
Administrators configure external identity providers to support authentication protocols such as SAML/WS-Fed and OpenID Connect, as well as social federation. This flexibility allows external users to verify their identities using trusted, pre-existing accounts. To remain compliant with privacy regulations like GDPR, organizations must publish clear privacy information within their tenant properties so external guests can easily find contact details. Regular audit logs and access reviews help track these external accounts and ensure that only authorized users maintain access to company data.
Microsoft Entra External ID acts as the central control plane to connect external identities to your custom web and mobile applications. To establish trust between the application and external identity providers, Azure supports standards like SAML/WS-Fed and OpenID Connect, alongside social logins. Traffic flows securely from the application to the identity provider to verify the user, and then returns a token to grant application access.
To control how external users register, administrators configure sign-up and sign-in user flows. These flows define the exact steps a customer takes, such as verifying an email address or inputting custom attributes like a physical address. Developers can brand these screens and set preferred languages, creating a user-friendly entry point that guides the user from registration to active application use.
Integrating external identities also means governing how those users exit the application environment. Administrators configure external collaboration settings, which include self-service leave rules and account deletion policies. When a user account is removed, the system places it into a soft deleted state for a 30-day grace period, ensuring that accidental deletions can be recovered. Once this window closes, the system automatically triggers a permanent deletion to protect user privacy and maintain clean directory environments.
Azure AD B2B collaboration is a secure feature that allows organizations to share their applications and services with guests from external companies. Instead of managing local credentials for these guests, the resource directory trusts the partner's home identity provider to handle authentication. This dependency ensures that if a partner leaves their company and their home account is disabled, they automatically lose access to your shared resources. This mechanism lowers administrative costs, reduces complexity, and keeps corporate data secure.
To prevent unauthorized access over time, organizations use governed collaboration practices to manage guest lifecycles. Administrators can set up entitlement management to define automated, time-bound access packages for specific external partners. This approach empowers business owners to delegate management tasks while ensuring that external permissions are regularly reviewed and revoked when no longer needed. Governing these boundaries minimizes the risk of data leakage and helps organizations meet strict compliance targets.
B2B collaboration integrates directly with core Microsoft services to streamline daily workflows. For example, internal users can securely share files and collaboration spaces directly through SharePoint and OneDrive without exposing the wider network. It also supports various enterprise and social identity providers, making it easy for guests to sign in with their existing work credentials. These integrated boundaries protect internal systems while allowing seamless, secure cross-company teamwork.
Using external identities introduces distinct security mechanisms for both business and customer environments. For B2B scenarios, organizations can enforce Conditional Access and multi-factor authentication (MFA) on guest users before they can touch corporate resources. For B2C environments, built-in features like email verification and custom user flows protect user registration by confirming the sign-up is legitimate. These security boundaries allow organizations to establish strict access controls while keeping the sign-in experience straightforward for legitimate users.
While external identities offer strong security benefits, they also introduce specific trust dependencies. Because B2B collaboration relies on the security of the partner’s identity provider, an organization is partially dependent on the partner’s credential strength and sign-in policies. For B2C, administrators face operational constraints, such as a default seven-day log retention period and different licensing rules compared to standard enterprise accounts. Managing these tradeoffs requires administrators to establish clear guardrails to protect customer data without disrupting the user experience.
To maintain a secure environment, administrators must combine Conditional Access with risk-based policies that trigger MFA during unusual sign-in events. Regular access reviews must be scheduled to check if guests still require access, preventing permissions from lingering indefinitely. Finally, configuring audit logs and checking usage reports helps security teams spot suspicious patterns early, ensuring that both partner and customer portals remain secure.