1
00:00:00,000 --> 00:00:03,340
Actually, most people think identity is just a user name and password.

2
00:00:03,340 --> 00:00:05,320
You type it in, you get access and done.

3
00:00:05,320 --> 00:00:09,200
But when you're a business serving customers, identity gets way more complicated.

4
00:00:09,200 --> 00:00:12,080
What happens when your app needs to let thousands of people sign up?

5
00:00:12,080 --> 00:00:15,760
Or let them sign in with their Google account instead of creating yet another password?

6
00:00:15,760 --> 00:00:20,400
And how do you keep all that customer data safe without mixing it up with your employee directory?

7
00:00:20,400 --> 00:00:23,720
That's exactly the problem Microsoft Entra external ID was built to solve.

8
00:00:23,720 --> 00:00:27,200
Here's the thing, it's replacing Azure ADB to see entirely.

9
00:00:27,200 --> 00:00:30,440
By the end of this episode, you'll understand what external ID actually is,

10
00:00:30,440 --> 00:00:35,280
the three main ways you'd use it and why it matters for any customer facing app.

11
00:00:35,280 --> 00:00:38,040
The old way, separate identity silos.

12
00:00:38,040 --> 00:00:41,120
Imagine it's 20 years ago and you've built an app for customers.

13
00:00:41,120 --> 00:00:44,920
Back then, you'd roll your own login system, write the code for passwords,

14
00:00:44,920 --> 00:00:49,080
set up a database to store them, build the forgot password flow, all from scratch.

15
00:00:49,080 --> 00:00:52,600
That worked fine for a small app with a few hundred users, but as apps grew,

16
00:00:52,600 --> 00:00:54,120
things got complicated fast.

17
00:00:54,120 --> 00:00:58,800
The companies needed to let users sign in with Google or Facebook, they needed multi factor authentication,

18
00:00:58,800 --> 00:01:01,640
and they needed to handle millions of accounts without breaking.

19
00:01:01,640 --> 00:01:04,120
Building all that yourself, it became a nightmare.

20
00:01:04,120 --> 00:01:06,880
Microsoft's first answer was Azure ADB to see.

21
00:01:06,880 --> 00:01:10,560
It was a customer identity service and at the time it solved a real problem.

22
00:01:10,560 --> 00:01:12,120
But here's where the pain started.

23
00:01:12,120 --> 00:01:17,120
The biggest issue was something called custom policies and those policies were written in XML.

24
00:01:17,120 --> 00:01:20,200
If you've ever worked with XML files that span hundreds of lines,

25
00:01:20,200 --> 00:01:22,080
you know exactly how painful that is.

26
00:01:22,080 --> 00:01:26,360
Hard to configure, hard to debug and when something broke, good luck figuring out why.

27
00:01:26,360 --> 00:01:30,440
On top of that, Azure ADB to see was separate from Microsoft's main identity platform.

28
00:01:30,440 --> 00:01:35,040
So if you already had Microsoft 365 or Azure AD for your employees,

29
00:01:35,040 --> 00:01:37,760
B2C felt like learning a completely new product.

30
00:01:37,760 --> 00:01:40,280
As you'd expect, IT teams struggled to maintain it,

31
00:01:40,280 --> 00:01:44,400
developers dreaded working with it, and customers ended up with a clunky signup experience

32
00:01:44,400 --> 00:01:45,880
that made them want to leave.

33
00:01:45,880 --> 00:01:49,040
Microsoft realized they needed something simpler and more unified.

34
00:01:49,040 --> 00:01:51,960
And that's exactly what became Microsoft's internal ID.

35
00:01:51,960 --> 00:01:54,600
What Microsoft's internal ID actually is.

36
00:01:54,600 --> 00:01:57,120
So what exactly is Microsoft's internal ID?

37
00:01:57,120 --> 00:01:58,400
Here's the simplest definition.

38
00:01:58,400 --> 00:02:03,080
It's a cloud identity service for external users, customers, partners and guests.

39
00:02:03,080 --> 00:02:03,880
Not employees.

40
00:02:03,880 --> 00:02:04,920
Think of it this way.

41
00:02:04,920 --> 00:02:06,720
Imagine your company has an office building.

42
00:02:06,720 --> 00:02:07,920
That's your workforce tenant.

43
00:02:07,920 --> 00:02:11,720
It's where your employees work, where their desks are, where their badges let them in.

44
00:02:11,720 --> 00:02:13,480
EntraID manages that building.

45
00:02:13,480 --> 00:02:16,120
Now imagine you're opening a storefront for customers.

46
00:02:16,120 --> 00:02:17,000
A separate space.

47
00:02:17,000 --> 00:02:19,320
Its own entrance, its own rules, its own security.

48
00:02:19,320 --> 00:02:21,880
Customers don't wander into the employee break room.

49
00:02:21,880 --> 00:02:24,520
And employees don't accidentally access customer accounts.

50
00:02:24,520 --> 00:02:25,800
That's external ID.

51
00:02:25,800 --> 00:02:28,920
It's part of the Microsoft Entra family, but a different flavor.

52
00:02:28,920 --> 00:02:32,320
It's built for CM, customer identity and access management.

53
00:02:32,320 --> 00:02:35,720
And it handles the whole life cycle of an external user.

54
00:02:35,720 --> 00:02:40,240
Sign up, sign in, password reset, profile management, MFA, token issuance.

55
00:02:40,240 --> 00:02:43,920
It works with standard protocols like OAuth 2.0, open ID connect and

56
00:02:43,920 --> 00:02:44,520
SAML.

57
00:02:44,520 --> 00:02:46,480
So almost any app you build can connect.

58
00:02:46,480 --> 00:02:50,680
But here's the big difference from the old Azure ADB2C external ID is simpler.

59
00:02:50,680 --> 00:02:52,320
No more custom XML policies.

60
00:02:52,320 --> 00:02:55,520
Instead you configure user flows directly in the admin center.

61
00:02:55,520 --> 00:03:00,040
Or you use custom authentication extensions that hook into your existing backend logic.

62
00:03:00,040 --> 00:03:02,000
Same power, less headache.

63
00:03:02,000 --> 00:03:03,800
The three core use cases.

64
00:03:03,800 --> 00:03:05,720
So how do you actually use external ID?

65
00:03:05,720 --> 00:03:06,920
There are three main scenarios.

66
00:03:06,920 --> 00:03:11,280
They cover almost every situation where you need to manage someone who isn't an employee.

67
00:03:11,280 --> 00:03:14,960
Start with the most common one, customer identity or B2C.

68
00:03:14,960 --> 00:03:17,080
Imagine you're building a pizza ordering app.

69
00:03:17,080 --> 00:03:20,640
You need people to sign up, place orders and come back next week.

70
00:03:20,640 --> 00:03:24,400
You want them to sign in with their Google account instead of creating another password.

71
00:03:24,400 --> 00:03:27,680
And you need to collect their name, phone number and delivery preferences.

72
00:03:27,680 --> 00:03:29,160
External ID handles all of that.

73
00:03:29,160 --> 00:03:31,560
You get pre-built sign up and sign in flows.

74
00:03:31,560 --> 00:03:33,800
You configure which attributes to collect.

75
00:03:33,800 --> 00:03:36,160
Name, phone, whatever you need.

76
00:03:36,160 --> 00:03:40,040
You set up social sign in with Google, Facebook or Apple.

77
00:03:40,040 --> 00:03:44,360
And when a user authenticates, external ID issues a token to your app so

78
00:03:44,360 --> 00:03:46,120
it knows who that person is.

79
00:03:46,120 --> 00:03:48,480
This is the replacement for Azure ADB2C.

80
00:03:48,480 --> 00:03:50,360
And it's where most organizations start.

81
00:03:50,360 --> 00:03:53,640
The scenario is business to business collaboration or B2B.

82
00:03:53,640 --> 00:03:57,880
This is when you need to give partners or vendors access to your internal apps.

83
00:03:57,880 --> 00:04:02,440
Maybe you have a share point site that your external logistics partner needs to see.

84
00:04:02,440 --> 00:04:05,320
Or a project management tool that your freelance designers use.

85
00:04:05,320 --> 00:04:09,200
In this scenario, you invite them as guest users in your workforce tenant.

86
00:04:09,200 --> 00:04:13,840
External ID handles the invitation email, the redemption process where they accept the invite,

87
00:04:13,840 --> 00:04:16,400
and the access policies that control what they can see.

88
00:04:16,400 --> 00:04:21,320
This has actually been around for years as B2B collaboration inside Azure AD.

89
00:04:21,320 --> 00:04:24,720
But now it's part of the external ID umbrella so you manage it from the same place as your

90
00:04:24,720 --> 00:04:26,320
customer identities.

91
00:04:26,320 --> 00:04:28,480
Then there's machine to machine or M2M.

92
00:04:28,480 --> 00:04:31,400
This one is less visible to end users but just as important.

93
00:04:31,400 --> 00:04:35,800
Sometimes your backend service needs to talk to another API, a payment processor, a data

94
00:04:35,800 --> 00:04:38,160
analytic service or an internal microservice.

95
00:04:38,160 --> 00:04:39,200
There's no human involved.

96
00:04:39,200 --> 00:04:41,520
It's just one application calling another.

97
00:04:41,520 --> 00:04:45,240
External ID uses the OAuth 2.0 client credentials flow.

98
00:04:45,240 --> 00:04:49,360
Your service authenticates itself using a client ID and a secret and it gets a token to call

99
00:04:49,360 --> 00:04:50,960
the downstream API.

100
00:04:50,960 --> 00:04:54,160
This requires the M2M premium add-on so there's a cost factor.

101
00:04:54,160 --> 00:04:57,840
But if you need to secure API to API communication, it's built right in.

102
00:04:57,840 --> 00:05:02,600
Now these three scenarios cover almost every external identity situation you'll run into.

103
00:05:02,600 --> 00:05:06,440
But there's a big decision you need to make and that's where those users actually live.

104
00:05:06,440 --> 00:05:09,560
Because external ID can run in two very different places.

105
00:05:09,560 --> 00:05:11,640
Workforce tenant versus external tenant.

106
00:05:11,640 --> 00:05:15,280
Just break down the two options external ID can run inside your existing workforce tenant

107
00:05:15,280 --> 00:05:17,680
or it can run as a completely separate external tenant.

108
00:05:17,680 --> 00:05:21,640
They are not the same thing and picking the wrong one can cause problems down the road.

109
00:05:21,640 --> 00:05:23,280
Start with the workforce tenant option.

110
00:05:23,280 --> 00:05:26,360
Your company already has an enter ID tenant for your employees.

111
00:05:26,360 --> 00:05:27,760
That's your workforce tenant.

112
00:05:27,760 --> 00:05:32,400
If you enable a feature called guest/self-service signup inside that tenant, external users can

113
00:05:32,400 --> 00:05:35,160
sign up and land in the same directory as your employees.

114
00:05:35,160 --> 00:05:37,720
They are accounts set right next to your CEO's account.

115
00:05:37,720 --> 00:05:42,160
Your simpler B2B scenarios like inviting a handful of partners to a sharepoint site, mixing

116
00:05:42,160 --> 00:05:44,320
them in the same directory is perfectly fine.

117
00:05:44,320 --> 00:05:47,240
It's simple to set up and you don't need to manage a separate tenant.

118
00:05:47,240 --> 00:05:48,240
But here's the thing.

119
00:05:48,240 --> 00:05:51,560
If you're building a customer facing app with thousands of users, you don't want those

120
00:05:51,560 --> 00:05:54,600
customers living in the same directory as your employees.

121
00:05:54,600 --> 00:05:55,600
That's a security risk.

122
00:05:55,600 --> 00:05:58,080
An employee could accidentally stumble into customer data.

123
00:05:58,080 --> 00:06:01,840
A configuration change meant for employees could affect customer access.

124
00:06:01,840 --> 00:06:05,280
And your branding for customer sign in pages would be tied to whatever you've set up for

125
00:06:05,280 --> 00:06:06,280
your company.

126
00:06:06,280 --> 00:06:07,280
That's not ideal.

127
00:06:07,280 --> 00:06:09,120
The alternative is the external tenant option.

128
00:06:09,120 --> 00:06:13,040
You create a brand new isolated directory specifically for customer identities.

129
00:06:13,040 --> 00:06:14,040
No employees live here.

130
00:06:14,040 --> 00:06:15,400
It's a completely separate space.

131
00:06:15,400 --> 00:06:17,400
Remember the office building analogy from earlier?

132
00:06:17,400 --> 00:06:19,560
The workforce tenant is your corporate headquarters.

133
00:06:19,560 --> 00:06:23,280
The external tenant is the dedicated storefront you open for your customers.

134
00:06:23,280 --> 00:06:27,200
They have their own entrance, their own rules, and their own security.

135
00:06:27,200 --> 00:06:28,200
Nothing gets mixed up.

136
00:06:28,200 --> 00:06:30,400
So what are the benefits of an external tenant?

137
00:06:30,400 --> 00:06:33,080
First you get an isolated user store.

138
00:06:33,080 --> 00:06:37,080
Customer data stays completely separate from employee data, which reduces risk and simplifies

139
00:06:37,080 --> 00:06:38,080
compliance.

140
00:06:38,080 --> 00:06:39,440
Second you get separate branding.

141
00:06:39,440 --> 00:06:43,440
You can customize the look and feel of sign in pages specifically for your customers without

142
00:06:43,440 --> 00:06:45,440
affecting anything in your corporate tenant.

143
00:06:45,440 --> 00:06:49,680
Third you get the native authentication API for mobile apps, which lets you build completely

144
00:06:49,680 --> 00:06:52,600
custom login screens inside your iOS or Android app.

145
00:06:52,600 --> 00:06:55,240
No browser redirects, no clunky web views.

146
00:06:55,240 --> 00:06:58,400
And fourth you get MAU based pricing, monthly active users.

147
00:06:58,400 --> 00:07:03,160
You only pay for the users who actually authenticate in a given month, which scales naturally with

148
00:07:03,160 --> 00:07:04,360
your customer growth.

149
00:07:04,360 --> 00:07:05,720
So when do you choose which?

150
00:07:05,720 --> 00:07:09,440
It's pretty straightforward if you're building a B2C app with thousands of customers, go

151
00:07:09,440 --> 00:07:10,920
with an external tenant.

152
00:07:10,920 --> 00:07:14,200
That's the recommended approach, and it's what external ID was designed for.

153
00:07:14,200 --> 00:07:18,080
If you're just inviting a few partners to access internal resources, the workforce tenant

154
00:07:18,080 --> 00:07:19,080
option is fine.

155
00:07:19,080 --> 00:07:22,880
The key is understanding the difference before you start building, because migrating from

156
00:07:22,880 --> 00:07:25,640
one to the other later is not trivial.

157
00:07:25,640 --> 00:07:28,040
Security, MFA, and conditional access.

158
00:07:28,040 --> 00:07:29,800
Now let's talk about security.

159
00:07:29,800 --> 00:07:33,200
If you're going to let customers into your app, you need to make sure the wrong people

160
00:07:33,200 --> 00:07:34,520
don't get in.

161
00:07:34,520 --> 00:07:38,600
Internal ID includes the same enterprise grade security features that intra ID offers for

162
00:07:38,600 --> 00:07:39,640
employees.

163
00:07:39,640 --> 00:07:44,360
That means multi-factor authentication, conditional access, and risk-based policies.

164
00:07:44,360 --> 00:07:46,920
For MFA, you've got two options right now.

165
00:07:46,920 --> 00:07:48,440
Email one-time passcode is free.

166
00:07:48,440 --> 00:07:51,760
The system sends a code to the user's email, they type it in, done.

167
00:07:51,760 --> 00:07:55,480
SMS one-time passcode works the same way it goes to their phone and there are carrier costs

168
00:07:55,480 --> 00:07:56,480
involved.

169
00:07:56,480 --> 00:07:59,400
One thing to note, there's no Microsoft Authenticator support yet.

170
00:07:59,400 --> 00:08:02,840
That's a current limitation, and it's something Microsoft is likely working on, but for

171
00:08:02,840 --> 00:08:05,000
now, it's email or SMS.

172
00:08:05,000 --> 00:08:07,040
Conditional access is where things get interesting.

173
00:08:07,040 --> 00:08:11,640
You can define rules that say things like require MFA when the sign-in-risk is medium or higher

174
00:08:11,640 --> 00:08:14,920
or block access from countries we don't do business in.

175
00:08:14,920 --> 00:08:18,120
The system evaluates each login attempt in real time.

176
00:08:18,120 --> 00:08:23,160
If someone tries to sign in from a location or device that looks suspicious, it can automatically

177
00:08:23,160 --> 00:08:27,560
step up the security requirements without you having to build any of that logic yourself.

178
00:08:27,560 --> 00:08:30,640
But there's one feature that really stands out, step-up authentication.

179
00:08:30,640 --> 00:08:31,640
Here's how it works.

180
00:08:31,640 --> 00:08:35,600
The user logs into your app with just a password to browse your product catalog.

181
00:08:35,600 --> 00:08:37,360
That's fine for low-risk activities.

182
00:08:37,360 --> 00:08:41,320
But when they try to view their payment history or download an invoice, you want additional

183
00:08:41,320 --> 00:08:42,560
verification.

184
00:08:42,560 --> 00:08:46,760
With step-up authentication, you can require MFA only for specific sections of your app.

185
00:08:46,760 --> 00:08:50,080
The user doesn't get prompted until they try to access something sensitive.

186
00:08:50,080 --> 00:08:54,320
And it's all handled by external ID behind the scenes using something called authentication

187
00:08:54,320 --> 00:08:55,320
context.

188
00:08:55,320 --> 00:08:59,040
You define which parts of your app need extra security and the system takes care of the

189
00:08:59,040 --> 00:09:00,040
rest.

190
00:09:00,040 --> 00:09:05,360
The user gets a smooth experience for basic browsing, but the sensitive data stays protected.

191
00:09:05,360 --> 00:09:06,880
Branding and user experience.

192
00:09:06,880 --> 00:09:10,920
Branding control is one of the biggest reasons organizations go with external ID instead of

193
00:09:10,920 --> 00:09:12,720
building their own login system.

194
00:09:12,720 --> 00:09:16,440
You get full control over the look and feel of your sign-up and sign-in pages, upload your

195
00:09:16,440 --> 00:09:20,720
logo, set background colors, add a fabric on for the browser tab, and customize the header

196
00:09:20,720 --> 00:09:24,120
and footer with links to your privacy policy and terms of service.

197
00:09:24,120 --> 00:09:28,160
If you want even more control, you can upload a custom CSS file to override fonts, button

198
00:09:28,160 --> 00:09:29,160
colors and layout.

199
00:09:29,160 --> 00:09:32,000
It's your brand, your colors, everything you decide.

200
00:09:32,000 --> 00:09:34,080
Now here's where things get a bit tricky.

201
00:09:34,080 --> 00:09:36,480
Branding is global, pertinent, not per application.

202
00:09:36,480 --> 00:09:41,000
So if you have multiple apps, say a customer portal and a mobile app, they all share the same

203
00:09:41,000 --> 00:09:42,320
branded pages.

204
00:09:42,320 --> 00:09:47,440
You can't give each app its own look, the old Azure ADB2C let you do per application branding,

205
00:09:47,440 --> 00:09:49,720
but external ID doesn't support that yet.

206
00:09:49,720 --> 00:09:53,080
Another limitation, error messages on login pages are not customizable.

207
00:09:53,080 --> 00:09:56,560
If someone types an email that doesn't exist, they'll see something like, we couldn't

208
00:09:56,560 --> 00:09:59,640
find an account with this email address and you cannot change that text.

209
00:09:59,640 --> 00:10:03,880
For some organizations that's fine, but for others, especially those in regulated industries

210
00:10:03,880 --> 00:10:06,880
over the strict brand voice, it's a real problem.

211
00:10:06,880 --> 00:10:08,280
Mobile apps get a better option.

212
00:10:08,280 --> 00:10:11,960
External ID has a native authentication API for iOS and Android.

213
00:10:11,960 --> 00:10:16,440
Instead of redirecting users to a browser-based login page, you can build fully custom login

214
00:10:16,440 --> 00:10:18,160
screens inside your app.

215
00:10:18,160 --> 00:10:20,480
No browser redirect, no clunky web views.

216
00:10:20,480 --> 00:10:23,840
The user stays in your app the whole time and you control every pixel.

217
00:10:23,840 --> 00:10:29,600
It's a much smoother experience and it's one of those features as your ADB2C never had.

218
00:10:29,600 --> 00:10:31,280
Migration from Azure ADB2C.

219
00:10:31,280 --> 00:10:35,160
If you're already on Azure ADB2C, you're probably wondering what this means for you.

220
00:10:35,160 --> 00:10:39,720
Here's the thing, Microsoft will keep supporting B2C until at least 2030, so your existing

221
00:10:39,720 --> 00:10:41,560
tenants won't stop working tomorrow.

222
00:10:41,560 --> 00:10:43,240
But no new features are coming.

223
00:10:43,240 --> 00:10:48,760
All the innovation, past keys, native authentication, fraud protection is exclusive to external ID.

224
00:10:48,760 --> 00:10:50,840
You're on a platform that's essentially frozen.

225
00:10:50,840 --> 00:10:54,880
Microsoft has published official migration tools and guidance and there are two parts depending

226
00:10:54,880 --> 00:10:55,880
on your scale.

227
00:10:55,880 --> 00:11:00,760
For tenants with fewer than about 5 million directory objects, users, groups, custom attributes,

228
00:11:00,760 --> 00:11:03,240
standard migration is relatively straightforward.

229
00:11:03,240 --> 00:11:05,280
It works like a tenant to tenant move.

230
00:11:05,280 --> 00:11:10,040
You create a new external ID tenant, migrate your users and their credentials, then cut over

231
00:11:10,040 --> 00:11:11,640
your applications.

232
00:11:11,640 --> 00:11:15,760
Microsoft provides tools for bulk user export and import and you can use just in time password

233
00:11:15,760 --> 00:11:19,160
migration to keep disruption low during the transition.

234
00:11:19,160 --> 00:11:23,160
For larger tenants with over 5 million directory objects, there's high scale compatibility mode

235
00:11:23,160 --> 00:11:24,280
or HSC.

236
00:11:24,280 --> 00:11:29,400
In this mode, Azure ADB2C and external ID run side by side in the same tenant.

237
00:11:29,400 --> 00:11:34,200
Your existing B2C endpoints stay active while you gradually move applications over.

238
00:11:34,200 --> 00:11:38,360
It's designed for organizations that can't migrate millions of users overnight, but it comes

239
00:11:38,360 --> 00:11:39,360
with trade-offs.

240
00:11:39,360 --> 00:11:43,640
No social identity providers, no past keys, limited conditional access and some features

241
00:11:43,640 --> 00:11:45,000
simply aren't available.

242
00:11:45,000 --> 00:11:47,360
Think of it as a bridging strategy, not a permanent solution.

243
00:11:47,360 --> 00:11:50,240
Now, a major change, custom policies are gone.

244
00:11:50,240 --> 00:11:55,000
If you've built complex authentication flows using Azure ADB2C's XML based identity experience

245
00:11:55,000 --> 00:11:59,160
framework, those won't work in external ID, you'll have to rebuild that logic using user

246
00:11:59,160 --> 00:12:01,680
flows and custom authentication extensions.

247
00:12:01,680 --> 00:12:04,880
There's no magic tool that converts your XML into the new format.

248
00:12:04,880 --> 00:12:06,280
You just have to do the work.

249
00:12:06,280 --> 00:12:07,600
So here's what it comes down to.

250
00:12:07,600 --> 00:12:10,160
If you're starting fresh today, use external ID.

251
00:12:10,160 --> 00:12:12,280
There's no reason to even look at B2C.

252
00:12:12,280 --> 00:12:15,480
If you have an existing B2C tenant, start planning your migration node.

253
00:12:15,480 --> 00:12:19,360
You've got until 2030, but waiting until the last minute means you'll be rushing through

254
00:12:19,360 --> 00:12:23,080
a complex migration while trying to keep existing apps running.

255
00:12:23,080 --> 00:12:24,080
Start small.

256
00:12:24,080 --> 00:12:28,600
Pick one application, migrate it, test it, learn from the process, then do the rest.

257
00:12:28,600 --> 00:12:30,600
Developer experience and automation.

258
00:12:30,600 --> 00:12:34,960
Microsoft really focused on making external ID easy for developers, and it's a huge change

259
00:12:34,960 --> 00:12:37,320
from the old B2C custom policies.

260
00:12:37,320 --> 00:12:40,680
You know those XML files that stretched for hundreds of lines and broke if you misplaced

261
00:12:40,680 --> 00:12:41,680
a single bracket?

262
00:12:41,680 --> 00:12:42,680
That's gone.

263
00:12:42,680 --> 00:12:46,600
There's a visual studio code extension called Microsoft Entra External ID.

264
00:12:46,600 --> 00:12:50,040
After you authenticate, you can browse your tenant, view user flows, download them as

265
00:12:50,040 --> 00:12:54,520
JSON files, and even preview your branding, all without leaving your editor.

266
00:12:54,520 --> 00:12:57,760
You see what your sign-in page looks like before you ever publish it?

267
00:12:57,760 --> 00:13:00,040
Then there's the Microsoft Graph API.

268
00:13:00,040 --> 00:13:04,520
Almost every external ID resource, user flows, app registrations, branding can be managed

269
00:13:04,520 --> 00:13:05,520
programmatically.

270
00:13:05,520 --> 00:13:09,880
That means you automate tenant setup in your CIR, CD pipelines, using PowerShell or rest

271
00:13:09,880 --> 00:13:14,680
calls, create a new tenant, configure the user flows, register your app, setup branding,

272
00:13:14,680 --> 00:13:15,880
all from a script.

273
00:13:15,880 --> 00:13:19,080
If you manage multiple environments, that saves a ton of time.

274
00:13:19,080 --> 00:13:21,560
Custom authentication extensions are where the real power lives.

275
00:13:21,560 --> 00:13:26,720
Instead of complex XML, you extend authentication flows with simple HTTP calls to add your functions.

276
00:13:26,720 --> 00:13:28,840
There are four events you can hook into.

277
00:13:28,840 --> 00:13:34,160
Token issuance start lets you add custom claims to tokens, like roles or loyalty tier info.

278
00:13:34,160 --> 00:13:38,960
Attribute collection, start, and submit, let you validate or prefill sign-up data by calling

279
00:13:38,960 --> 00:13:40,200
your own backend.

280
00:13:40,200 --> 00:13:43,560
An email OTP sent lets you customize the verification emails.

281
00:13:43,560 --> 00:13:47,200
It's the same flexibility B2C had, but in a model any developer can work with.

282
00:13:47,200 --> 00:13:48,760
There are limitations to know.

283
00:13:48,760 --> 00:13:52,680
No Microsoft Graph notifications yet, so you can't automatically trigger a workflow when

284
00:13:52,680 --> 00:13:54,160
a new user signs up.

285
00:13:54,160 --> 00:13:57,840
Some configurations still need to be done manually in the admin center, and there's no built-in

286
00:13:57,840 --> 00:13:59,160
edit profile page.

287
00:13:59,160 --> 00:14:02,800
If you want users to update their information, you need to build that page in your app and

288
00:14:02,800 --> 00:14:04,520
call the Graph API yourself.

289
00:14:04,520 --> 00:14:06,120
But the direction is clear.

290
00:14:06,120 --> 00:14:08,760
Microsoft wants external ID to be fully automatable.

291
00:14:08,760 --> 00:14:11,080
That makes it easier to manage its scale.

292
00:14:11,080 --> 00:14:16,360
So now you know, Microsoft Entra external ID is the modern replacement for Azure AD B2C

293
00:14:16,360 --> 00:14:18,280
unified under the Entra brand.

294
00:14:18,280 --> 00:14:23,120
The three use cases, custom identity, partner collaboration, and machine to machine.

295
00:14:23,120 --> 00:14:27,160
Cover almost every external identity need you'll run into, and the key decision is whether

296
00:14:27,160 --> 00:14:30,520
to use your workforce tenant or create a separate external tenant.

297
00:14:30,520 --> 00:14:34,120
For customer facing apps, separate is almost always better.

298
00:14:34,120 --> 00:14:35,960
Identity is the front door to your application.

299
00:14:35,960 --> 00:14:42,480
Using it right, secure, branded, and simple directly impacts user trust and business growth.

300
00:14:42,480 --> 00:14:47,120
Your homework, head over to Entra, Microsoft.com, create an external tenant, and try the

301
00:14:47,120 --> 00:14:48,600
get started guide.

302
00:14:48,600 --> 00:14:51,560
It'll walk you through setting up a sample app in minutes.

303
00:14:51,560 --> 00:14:55,000
Subscribe for more plain English breakdowns of Microsoft's identity platform.