Microsoft Entra External ID

Analyze Azure AD B2C custom policies for Microsoft Entra External ID migration

The custom policies guidance now includes a screenshot of the Migration Policy Analyzer UI and updated author metadata.

Partners for Azure AD B2C to Microsoft Entra External ID migrations

The migration partners page now lists Fortytwo and updates its publication date.

Services Integration Partners

The Edgile listing now links to its Microsoft Entra External ID page instead of its previous blog post.

Identity verification integration for Microsoft Entra External ID

A new article compares three identity verification patterns: Verified ID credentials, direct REST API claims, and OIDC federation. It explains partner-based proofing, External ID authentication, setup considerations, and handling of longer-running verification journeys.

Entra Id Federation Customers

The user-creation example replaces the source tenant ID with its primary domain name in the issuer value and defines the new placeholder with an example domain.

Add OIDC for customer sign-in

The page now explains self-service sign-up through a user flow and invitation redemption through a custom OIDC provider using the domain_hint authorization parameter.

Disable sign-up in a sign-up and sign-in user flow

The article now highlights testing the user flow as the primary next step and adds links for adding applications, managing custom attributes, and routing invited users to an external identity provider.

Entra Id Federation Customers

The documentation now clarifies that invited users from another Microsoft Entra tenant use the default redemption flow unless an application explicitly routes them to a custom OIDC provider. The related link was also updated.

Route Invited Users to an External Identity Provider

New guidance explains how to use the domain_hint parameter to route invited external-tenant users to configured OpenID Connect, SAML/WS-Federation, or social identity providers. It covers prerequisites, invitations through Microsoft Graph or the admin center, and custom invitation emails.

Cross Tenant Access Overview

The overview now states that a Microsoft Entra ID P1 license is required on the configured tenant to change the default redemption order, in addition to configuring trust or scoped access settings.

Cross Tenant Access Overview

The documentation now states that changing the default redemption order, like configuring trust or access settings, requires Microsoft Entra ID P1 on the configured tenant.

Add custom headers to native authentication requests in Android (Kotlin)

The Android custom headers tutorial no longer includes the author, manager, and ms.author metadata fields.

Analyze Azure AD B2C custom policies for Microsoft Entra External ID migration

The custom policy analysis article no longer includes the `author` and `ms.author` metadata fields.

Faq Customers

The documentation now states that SMS is unavailable only for first-factor authentication in external tenants, indicating availability for self-service password reset. SMS remains available for second-factor verification at additional cost.

Microsoft Entra External ID app samples and guides

The page title and description now use Microsoft Entra External ID terminology. Passkey sample links were updated from listing and registration to sign-in and management, and the sample table was revised.

Samples and guides for integrating apps with External ID

The page now links to a sample for listing and registering passkeys and documents delegated permissions for those operations. It also warns that deletion uses high-privilege application permissions and a client secret in browser code.

Sign In With Passkey

The documentation now describes a sample where signed-in customers list and register their own passkeys. It warns that the deletion flow uses high-privilege permissions and a client secret, so the sample is for test tenants only.

Sign in with passkeys in Microsoft Entra External ID

The page now describes administrator-controlled passkey provisioning with the FIDO2 provisioning APIs and identifies the sample as testing-only with high-privilege permissions.

Microsoft Entra External ID credential management API reference

Microsoft Entra External ID applications can use the credential management API to let signed-in customers list and register passkeys. The reference covers delegated authentication, permissions, and setup.

Sign In With Passkey

The documentation now directs applications to use the credential management API, with low-privilege delegated permissions, so signed-in customers can list and register their own passkeys.

Retirement of SharePoint One-Time Passcode (SPO OTP) and transition to Microsoft Entra B2B

SharePoint One-Time Passcode (SPO OTP) authentication will retire starting mid-October 2026, transitioning external sharing and authentication to Microsoft Entra B2B. This change affects all Microsoft 365 tenants, requiring guest accounts for external users and enabling consistent governance and Conditional Access across SharePoint and OneDrive.

Microsoft Entra ID: Enhance protection of the authentication experience by blocking external script injection

Microsoft Entra ID will enhance sign-in security by enforcing a Content Security Policy blocking external script injection starting mid-October 2026. Only trusted Microsoft scripts will run, affecting organizations using script-injecting tools on login.microsoftonline.com. No action needed if such tools aren't used.

Browser authentication for external identity providers in Microsoft Entra ID

Microsoft Entra can hand brokered external-IdP authentication from an embedded WebView to the system browser, enabling external-IdP passkeys, browser SSO, and IdPs that block WebViews. The documentation lists supported platforms, brokers, versions, apps, and cloud availability.

Add an identity provider to a user flow

A single article now documents how to add a configured OIDC, SAML/WS-Fed, or social identity provider to an External ID user flow, including prerequisites, permissions, portal steps, and testing.

Apple Federation Customers

The article now links to the authentication methods overview and the consolidated “Add an identity provider to a user flow” article instead of listing the Apple-specific setup steps inline.

Custom Oidc Federation Customers

The article’s step-by-step instructions and screenshot for adding an OIDC provider to a user flow were replaced with a link to a consolidated guide.

Direct Federation

The External tenants guidance now links to the consolidated article for adding a SAML/WS-Fed identity provider to a user flow.

Entra Id Federation Customers

The article now links to a consolidated guide for adding an identity provider to a user flow and reorganizes the sign-in and sign-up guidance. The duplicated setup and testing steps were removed.

Facebook Federation Customers

The article now links to a consolidated guide for adding Facebook as an identity provider to a user flow and updates the section heading and introductory guidance.

Google Federation Customers

The article now directs administrators to a consolidated guide for adding Google as an identity provider to a user flow, instead of listing the steps inline.

Manage User Profile Info

The user profile information guidance no longer includes the “Manage user feature settings” reference.

Manage User Profile Info

The user profile information documentation no longer includes guidance that users can use My Apps preview features or that administrators can access My Staff.

Microsoft Accounts Federation Customers

The article replaces its embedded steps and screenshot for adding the Microsoft account identity provider with a link to the shared user-flow guidance.

Saml Ws Federation Self Service Sign Up

The standalone article covering prerequisites and steps for adding a SAML or WS-Fed identity provider to a user flow was removed and consolidated into a single article referenced by the federation documentation.

Sign In With Passkey

The documentation no longer directs applications to the preview credential management API. It now recommends Microsoft Graph FIDO2 provisioning APIs and states that low-privilege passkey credential management APIs are on the roadmap.

Set up B2B direct connect

The documentation now explains how Microsoft Entra ID accepts compliant-device claims from an external user’s home tenant and how Conditional Access evaluates those claims. It also describes the trust implications and behavior when the setting is disabled.

Set up Microsoft Entra Verified ID

The new article explains how to use Quick setup, register applications, create credentials, and issue and verify credentials in a Microsoft Entra External ID tenant. It documents prerequisites and limits, including custom-domain requirements, shared signing keys, two requests per second per tenant, and six-month credential validity.

Create Service Principal Cross Tenant

The cross-tenant service principal article changes the example ServicePrincipalId from `bbbbbbbb-1111-2222-3333-cccccccccccc` to `aaaaaaaa-bbbb-cccc-1111-222222222222`.

Migrate Passwords Just In Time

The password migration documentation now uses a different example API application identifier.

Microsoft Entra External ID credential management API reference

Microsoft Entra External ID now documents an API that lets applications list, register, and delete signed-in customers’ passkeys using delegated access tokens.

Sign In With Passkey

The documentation now describes using the preview credential management API with delegated permissions so signed-in customers can list, register, and delete their own passkeys. It also clarifies that the sample uses high-privilege administrator provisioning and is for testing.

Microsoft Entra: Upcoming changes to federatedTokenValidationPolicy default settings

Microsoft Entra will update federatedTokenValidationPolicy by mid-August 2026 to block federated sign-ins when internalDomainFederation doesn't match the user's UPN domain, enhancing security. This affects federated domains configured before December 2025. Admins can customize the policy via Microsoft Graph but it's discouraged.

Allow Deny List

The guidance now includes an approximate domain-count example and reiterates that capacity depends on domain length within the 25 KB (25,000-character) policy limit.

Dynamics 365 Commerce – On-behalf-of support now available in Microsoft Entra External ID

We are announcing the ability to enable on-behalf-of ordering for Microsoft Entra External ID (EEID) in Dynamics 365 Commerce. This feature will reach general availability on September 11, 2026 How does this affect me?

Configure cross-tenant synchronization

The guide now reflects revised Entra portal navigation and controls, including **New configuration**, **Create**, **Overview > Properties**, and **Attribute mapping**. It also updates terminology and scope-setting guidance.

Define Conditional Rules For Provisioning User Accounts

The documentation now directs administrators to Entra ID > Cross-tenant Synchronization > Configurations, removing the External Identities step.

Add OIDC for customer sign-in

Learn how to set up OpenID Connect as an external identity provider in Microsoft Entra External ID, enabling users to sign in using their existing accounts.

Gsa Poc Internet Access

1. [Set up tenant restrictions v2](/azure/active-directory/external-identities/tenant-restrictions-v2). If your organization currently uses tenant restrictions v1, review the [guide for migrating to tenant restrictions v2](https://aka.ms/trv2migration).

Sms Voice Retirement

Passkey support for B2B users and internal guest users is planned to be available by the end of calendar year 2026. These users are included in the scope of the retirement of Microsoft-provided SMS and voice authentication.

Custom Oidc Federation Customers

> [!IMPORTANT]

Analyze Azure AD B2C custom policies for Microsoft Entra External ID migration

Use the Migration Policy Analyzer to scan Azure AD B2C custom policies and generate a detailed migration assessment for Microsoft Entra External ID. Start your migration today.

Licensing Guest Users

Global Secure Access external user access licensing is supported through Microsoft Entra External ID subscription linking. The administrator must link the subscription in the resource tenant so guest users can access private resources and usage is billed correctly.

Migrate from Amazon Cognito to Microsoft Entra External ID

Learn to migrate from Amazon Cognito to Microsoft Entra External ID with step-by-step guidance, feature mapping, and validation strategies.

Troubleshoot

Organizations that are deploying passkeys and have Conditional Access policies that require phishing-resistant authentication when accessing **All resources (formerly 'All cloud apps')** can run into a looping issue when users attempt to add a passkey to Microsoft Authenticator. For more information and possible workarounds, see [Workarounds for an authentication strength Conditional Access policy loop](~/identity/authentication/how-to-enable-authenticator-passkey.md#workarounds-for-an-authentication-strength-conditional-access-policy-loop).

Cross Tenant Synchronization Overview

Deployment External Operations

Learn about edge protection, domains, subscriptions, consumer app security, and fraud tactics in security operations for Microsoft Entra External ID.

Choose Authentication Approach

Compare browser-delegated and native authentication in Microsoft Entra External ID and choose the right approach for your customer-facing app.

Direct Federation

Set up direct federation with SAML 2.0 or WS-Fed identity providers so users can sign in with work accounts. Understand attributes and claims for federation.

Sign in with alias

Learn how to sign in and sign up with alias/username with External ID for customer identity and access management (CIAM). Get detailed steps to enable username as a sign-in identifier and create users with both email address and username.

Tenant Configurations

Learn about tenant configurations in Microsoft Entra External ID, including the differences between workforce and external tenants.

Add Member To Group

Now that you've added app groups claim in your application, add users to the security groups. If you don't have security group, [create one](~/fundamentals/how-to-manage-groups.md#create-a-basic-group-and-add-members).

Zscaler B2b User Portal Tutorial

Zscaler B2B User Portal is available in the following [national cloud deployments](/graph/deployments).

External ID Pricing

Learn about the pricing and billing structure for Microsoft Entra External ID, along with steps for linking an external tenant to an Azure subscription.

Faq Customers

Microsoft Entra External ID pricing is based on monthly active users (MAU), which is the count of unique users with authentication activity within a calendar month. External ID consists of a core offer and premium add-ons. The Microsoft Entra External ID core offering is free for the first 50,000 MAU. For the latest information about usage billing and pricing, see [Billing model for Microsoft Entra External ID](../external-identities-pricing.md).

Add custom headers to native authentication requests in Android (Kotlin)

Learn how to attach custom x-* headers to native authentication network requests in an Android (Kotlin) app to integrate fraud-detection SDKs with Microsoft Entra External ID.

Direct Federation

1. On the **New SAML/WS-Fed IdP** page, enter the following:

Authentication Methods Customers

With Microsoft Entra External ID, you can create secure, customized sign-in experiences for your consumer- and business customer-facing apps. In an external tenant, there are several ways for users to sign up for your app. They can create an account using their email and either a password or a one-time passcode. Or, if you enable sign-in with Facebook, Google, Apple, a Microsoft Entra ID tenant, or a custom OIDC or SAML/WS-Fed identity provider (IdP), users can sign in using their credentials in the external identity provider. A user object is created for them in your directory with the identity information collected during sign-up.

Custom Extensions

Microsoft Entra External ID user flows are designed for flexibility. Within a sign-up and sign-in user flow, there are built-in authentication events. You can also add custom authentication extensions at specific points within the authentication flow. A custom authentication extension is essentially an event listener that, when activated, makes an HTTP call to a REST API endpoint where you define a workflow action. For example, you could add an [attribute collection](#attribute-collection-start-and-submit-events) workflow to validate the attributes a user enters during sign-up, or you could use a [custom claims provider](#token-issuance-start-event) to add external user data to the token before the token is issued.

Customize Branding Customers

> [!NOTE]

Customize the look and feel of the authentication experience for the external tenant

> [!NOTE]

Define Custom Attributes

> [!TIP]

Frequently asked questions

Find answers to frequently asked questions about Microsoft Entra External ID. Learn about pricing, features, and the future of Azure AD B2C and External Identities.

Multifactor Authentication Customers

Enforcing MFA enhances your organization's security by adding an extra layer of verification, making it more difficult for unauthorized users to gain access.

Planning Your Solution

Discover the steps for setting up a customer identity and access management (CIAM) solution in an external tenant, including creating a tenant, registering apps, and setting up user flows for sign-in.

Samples Ciam All

Microsoft maintains code samples that demonstrate how to integrate various application types with Microsoft Entra External ID. We provide instructions for downloading and using samples or building your own app based on common authentication and authorization scenarios, development languages, and platforms. Included are instructions for building the project (if applicable) and running the sample application. Within the sample code, comments help you understand how these libraries are used in the application to perform authentication and authorization in an external tenant.

Security Customers

Each layer addresses a different class of attacks, reducing the likelihood of compromise and limiting the blast radius.

User Flow Sign Up Sign In Customers

> [!TIP]

Add custom headers to native authentication network requests in iOS (Swift)

Learn how to attach custom x-* headers to native authentication network requests in an iOS (Swift) app to integrate fraud-detection SDKs with Microsoft Entra External ID.

Add custom headers to native authentication requests in JavaScript SPAs

Learn how to attach custom x-* headers to native authentication requests in a React or Angular SPA to integrate fraud-detection SDKs with Microsoft Entra External ID.

B2b Government National Clouds

Learn what features are available in Microsoft Entra B2B collaboration in US Government and national clouds

B2c Deployment Plans

Azure Active Directory B2C deployment guide for planning, implementation, and monitoring

Build resilience in customer identity and access management with Azure AD B2C

Learn methods to build resilience in customer identity and access management (CIAM) using Azure AD B2C.

Call an API in a Node.js web application

Learn how to call a protected API in your Node.js web application using access tokens from Microsoft Entra External ID.

Choose Authentication Approach

Compare browser-delegated and native authentication in Microsoft Entra External ID and choose the right approach for your customer-facing app.

Configure Microsoft Entra External ID with Azure Web Application Firewall

Learn how to configure Microsoft Entra External ID with Azure Web Application Firewall.

Convert local guest accounts to Microsoft Entra B2B guest accounts

Learn to convert local guests into Microsoft Entra B2B guest accounts by identifying apps and local guest accounts, migration, and more.

Create a Node.js web app that calls a web API

Learn how to prepare your Node.js client web app to call a protected API using access tokens from Microsoft Entra External ID.

Create Service Principal Cross Tenant

Create an enterprise application using the client ID for a multitenant application.

Cross Tenant Synchronization Governance

manager: martinco

Current Limitations

Current limitations for Microsoft Entra B2B collaboration

Custom roles for cross-tenant access settings

Learn how your organization can define custom roles to manage cross-tenant access settings, allowing for precise control without relying on built-in management roles.

Customer intent: As a B2B collaboration user flow administrator, I want to customize the language of the authentication experience in Microsoft Entra…

Learn about customizing the language experience in your user flows in Microsoft Entra External ID.

Customer intent: As a developer who creates apps for consumers and business customers, I want to understand the capabilities of Microsoft Entra Exter…

Compare solutions for using Microsoft Entra External ID to work with people outside your organization, including B2B collaboration and Azure AD B2C.

Customer intent: As an external identity provider (IdP) for Microsoft Entra ID, I want to learn how to configure an external MFA method for tenants.

Learn how to configure an external MFA method provider for Microsoft Entra multifactor authentication.

Customer intent: As an organization administrator, I want to customize the invitation process for external users using the Microsoft Graph REST API,…

A Microsoft Entra documentation page was updated: Customer intent: As an organization administrator, I want to customize the invitation process for external users using the Microsoft Graph REST API, so that I can tailor the onboarding experience and control the notifications sent to the users..

Direct Federation

Set up direct federation with SAML 2.0 or WS-Fed identity providers so users can sign in with work accounts. Understand attributes and claims for federation.

Disable sign-up in a sign-up and sign-in user flow

Disable sign-up in your user flow with Microsoft Graph API. Prevent new registrations and allow only sign-in for your external users.

Enable External ID High Scale Compatibility (HSC) mode

Enable HSC mode on your Azure AD B2C tenant to adopt Microsoft Entra External ID endpoints while keeping existing users and credentials in place.

Entra Id Federation Customers

Learn how to configure a Microsoft Entra ID tenant as an OpenID Connect identity provider in Microsoft Entra External ID, enabling users to sign in using their existing organizational accounts.

Hybrid Cloud To On Premises

Learn how to give cloud B2B users access to on-premises apps with Microsoft Entra B2B collaboration.

Implement Single Sign-On from Native Apps to Embedded Web Views

Learn how to implement SSO between a native mobile app and a web resource in an embedded web view using Microsoft Entra External ID native authentication.

Just-in-time password migration to Microsoft Entra External ID

Learn how to migrate passwords from another identity provider to Microsoft Entra External ID using Just-In-Time (JIT) Migration.

Leave The Organization

As a B2B collaboration user, learn how to leave an organization if you no longer need guest user access to apps. If you're an admin, see how to allow external users to leave.

Microsoft Entra External ID deployment architectures with Microsoft Entra

Learn to securely deploy and operate Microsoft Entra External ID architectures with Microsoft Entra.

Migrate from Azure AD B2C to Microsoft Entra External ID

Migrate users, credentials, and applications from Azure AD B2C to Microsoft Entra External ID using the standard migration approach.

Native authentication

Learn how to set up native authentication in Microsoft Entra External ID. Customize the user interface for mobile and desktop apps, and provide a seamless sign-in experience.

Plan a Tenant Restrictions v1 Migration to Tenant Restrictions v2

Learn about tenant-level restrictions and controls for users, groups, and applications, along with policy management in a cloud-based portal.

Plan your migration from Azure AD B2C to External ID

Choose between the standard migration approach and High Scale Compatibility (HSC) mode when moving from Azure AD B2C to Microsoft Entra External ID.

Quickstart: Add sign in to a JavaScript SPA

Learn how to run a sample JavaScript SPA to sign in users

Quickstart: Add sign in to a Node.js/Express web app

Learn how to run a sample Node.js/Express web app to sign in users

Quickstart: Add sign in to a Python Django web app

Learn how to run a sample Python Django web app to sign in users

Quickstart: Add sign in to a Python Flask web app

Learn how to run a sample Python Flask web app to sign in users

Quickstart: Add sign in to a React SPA

Learn how to run a sample React SPA to sign in users

Quickstart: Add sign in to an Angular SPA

Learn how to run a sample Angular SPA to sign in users

Quickstart: Add sign in to ASP.NET web app

Learn how to run a sample ASP.NET web app to sign in users

Resilience through developer best practices using Azure AD B2C

Resilience through developer best practices in Customer Identity and Access Management using Azure AD B2C

Resilience through monitoring and analytics using Azure AD B2C

Resilience through monitoring and analytics using Azure AD B2C

Resilient end-user experience using Azure AD B2C

Learn methods to build resilience in end-user experience with Azure AD B2C

Resilient interfaces with external processes using Azure AD B2C

Learn about methods to build resilient interfaces with external processes.

Retrieve and return data from an emailOtpSend event

Reference documentation for a custom authentication extension that invokes the emailOtpSend event for External ID customer configurations.