Microsoft Entra External ID IAM Provider

Azure-native IAM platform (successor to Azure AD B2C). Simple per-MAU consumption pricing with a 50K free tier. FedRAMP High authorized with deep Microsoft ecosystem integration.

Features

Authentication Methods

Username and Password
Social Sign-in
Passkey
Email Passwordless
Phone Passwordless
Magic Link
Anonymous / Guest

Integration Protocols

OpenID Connect (OIDC)
SAML 2.0
WS-Federation
Machine-to-Machine (M2M) Authentication

Identity Federation

OpenID Connect (OIDC) Federation
SAML 2.0 Federation
Active Directory / LDAP
Azure Active Directory (Entra ID)

Access Control & Authorization

Attribute-Based Access Control (ABAC)
Fine-Grained Authorization (FGA / ReBAC)
API Authorization (Scopes / Permissions)

Security

Audit Log Retention
Audit Log Streaming
Security Center (Threat Monitoring Dashboard)
Encryption at Rest
Encryption in Transit
Customer Managed Keys (BYOK)
Bot Detection
Brute Force Protection
Suspicious IP Throttling
Breached Password Detection
Credential Guard (Dark Web Monitoring)
Tenant Access Control List (IP ACL)
Device Fingerprinting

Multi-Tenancy / Organizations

Per-Organization Branding
Per-Organization MFA Policy

Branding & UX

Hosted / Universal Login Page
Embedded / Native Login Components
White-Label / Full Brand Removal
Localization / i18n
Prebuilt UI Components (SDK)

Compliance

SOC 2 Type II Certification
ISO 27001 / 27017 / 27018 Certification
HIPAA Business Associate Agreement (BAA)
PCI DSS Compliance
CSA STAR Certification
FedRAMP Authorization
GDPR: Data Export (Portability)
GDPR: Right to be Forgotten (User Deletion)
Consent Management
Region Deployment
🇺🇸US🇪🇺EU🇦🇺AU🇯🇵JP🇨🇦CA🇮🇳IN🇧🇷BR🇦🇵AP
Private Cloud Deployment
Azure

Developer Integration

SDK Coverage
Management API
Authentication API Rate Limits
Actions / Extensibility Pipeline
TypeScript Support in Extensibility
Custom Domain
Deploy CLI (Infrastructure as Code)
Terraform Provider
Custom Database Connections
Native Webhook Support
Universal Login / Hosted Login Page Customization
Custom Email Provider (SMTP)
Email Templates
Custom OIDC Claims / Token Enrichment

Advanced / Differentiators

No-Code Auth Flow Builder / Orchestration
Identity Verification / Document Proofing
Decentralized / Verifiable Credentials
Built-in Billing / Subscription Management
Agentic AI / MCP Server Authentication

If you want to compare IAM features of different providers, please check out the (C)IAM Identity Providers benchmark.

Looking for Microsoft Entra External ID’s OpenID Connect protocol compatibility? View Microsoft Entra External ID on the OpenID Connect Providers benchmark.

Frequently Asked Questions

Does Microsoft Entra External ID support Username and Password authentication method?

Microsoft Entra External ID supports Username and Password authentication method. Read more

Does Microsoft Entra External ID support Social Sign-in authentication method?

Microsoft Entra External ID supports Social Sign-in authentication method. Google, Facebook, Apple, custom OIDC/SAML providers. Read more

Does Microsoft Entra External ID support Passkey authentication method?

Microsoft Entra External ID supports Passkey authentication method. Passkeys (in Microsoft Authenticator) are now supported for external tenant customers. Read more

Does Microsoft Entra External ID support Email Passwordless authentication method?

Microsoft Entra External ID supports Email Passwordless authentication method. Email OTP passwordless sign-in. Read more

Does Microsoft Entra External ID support Phone Passwordless authentication method?

Microsoft Entra External ID supports Phone Passwordless authentication method. Phone OTP via SMS. Billed per SMS transaction. Read more

Does Microsoft Entra External ID support Magic Link authentication method?

Microsoft Entra External ID supports Magic Link authentication method. Email OTP-based magic link sign-in. Read more

Does Microsoft Entra External ID support Anonymous / Guest authentication method?

Microsoft Entra External ID does not support Anonymous / Guest authentication method.

Does Microsoft Entra External ID support Time-based One-Time Password (TOTP) MFA?

Microsoft Entra External ID supports Time-based One-Time Password (TOTP) MFA. Authenticator app TOTP MFA is supported. Read more

Does Microsoft Entra External ID support HMAC-based One-Time Password (HOTP) MFA?

Microsoft Entra External ID does not support HMAC-based One-Time Password (HOTP) MFA.

Does Microsoft Entra External ID support Universal 2nd Factor (U2F) MFA?

Microsoft Entra External ID supports Universal 2nd Factor (U2F) MFA. FIDO2 security keys are supported. Read more

Does Microsoft Entra External ID support WebAuthn MFA?

Microsoft Entra External ID supports WebAuthn MFA. WebAuthn MFA is supported. Read more

Does Microsoft Entra External ID support Email Code MFA?

Microsoft Entra External ID supports Email Code MFA. Read more

Does Microsoft Entra External ID support Phone Code MFA?

Microsoft Entra External ID supports Phone Code MFA. Per-transaction SMS cost. Read more

Does Microsoft Entra External ID support Recovery Code MFA?

Microsoft Entra External ID does not support Recovery Code MFA. Recovery codes are not available for external tenant customers.

Does Microsoft Entra External ID support Push Notification MFA?

Microsoft Entra External ID supports Push Notification MFA. Microsoft Authenticator Push MFA is supported. Read more

Does Microsoft Entra External ID support Adaptive / Risk-Based MFA MFA?

Microsoft Entra External ID partially supports Adaptive / Risk-Based MFA MFA. Risk-based MFA via Conditional Access policies. Read more

Does Microsoft Entra External ID support Cisco Duo MFA?

Microsoft Entra External ID does not support Cisco Duo MFA. Cisco Duo is not a supported MFA method for external tenant customers.

Does Microsoft Entra External ID support Step-Up Authentication MFA?

Microsoft Entra External ID supports Step-Up Authentication MFA. MFA step-up via Conditional Access authentication context (auth context IDs c1–c99). Require MFA only for sensitive operations. Read more

Does Microsoft Entra External ID support OpenID Connect (OIDC) integration protocol?

Microsoft Entra External ID supports OpenID Connect (OIDC) integration protocol. Read more

Does Microsoft Entra External ID support SAML 2.0 integration protocol?

Microsoft Entra External ID supports SAML 2.0 integration protocol. Read more

Does Microsoft Entra External ID support WS-Federation integration protocol?

Microsoft Entra External ID supports WS-Federation integration protocol. WS-Federation supported as an identity provider federation option. Enables federation with on-premises ADFS and WS-Fed identity providers. Read more

Does Microsoft Entra External ID support Machine-to-Machine (M2M) Authentication integration protocol?

Microsoft Entra External ID supports Machine-to-Machine (M2M) Authentication integration protocol. OAuth 2.0 client credentials flow. Read more

Does Microsoft Entra External ID support OpenID Connect (OIDC) Federation identity federation?

Microsoft Entra External ID supports OpenID Connect (OIDC) Federation identity federation. Read more

Does Microsoft Entra External ID support SAML 2.0 Federation identity federation?

Microsoft Entra External ID supports SAML 2.0 Federation identity federation. Read more

Does Microsoft Entra External ID support Active Directory / LDAP identity federation?

Microsoft Entra External ID supports Active Directory / LDAP identity federation. Active Directory integration via Azure AD Connect and federation. Read more

Does Microsoft Entra External ID support Azure Active Directory (Entra ID) identity federation?

Microsoft Entra External ID supports Azure Active Directory (Entra ID) identity federation. Native Microsoft Entra ID (Azure AD) integration as part of the Microsoft identity platform.

Does Microsoft Entra External ID support Bulk User Import user management?

Microsoft Entra External ID supports Bulk User Import user management. Bulk operations via Microsoft Graph API. Read more

Does Microsoft Entra External ID support Password Hash Import (Multiple Formats) user management?

Microsoft Entra External ID partially supports Password Hash Import (Multiple Formats) user management. Password hash import via Graph API bulk operations. Read more

Does Microsoft Entra External ID support Bulk User Export user management?

Microsoft Entra External ID supports Bulk User Export user management. Export users via Microsoft Graph API.

Does Microsoft Entra External ID support Bulk User Update / Delete user management?

Microsoft Entra External ID supports Bulk User Update / Delete user management. Bulk updates and deletes via Microsoft Graph API.

Does Microsoft Entra External ID support Inbound SCIM Provisioning user management?

Microsoft Entra External ID does not support Inbound SCIM Provisioning user management. SCIM provisioning is not available for external tenants. Read more

Does Microsoft Entra External ID support Outbound SCIM Provisioning user management?

Microsoft Entra External ID does not support Outbound SCIM Provisioning user management.

Does Microsoft Entra External ID support SCIM Groups Provisioning user management?

Microsoft Entra External ID does not support SCIM Groups Provisioning user management.

Does Microsoft Entra External ID support Just-In-Time (JIT) User Provisioning user management?

Microsoft Entra External ID supports Just-In-Time (JIT) User Provisioning user management. Just-in-time user creation via federated identity providers.

Does Microsoft Entra External ID support Lazy / Trickle Migration from Legacy Database user management?

Microsoft Entra External ID partially supports Lazy / Trickle Migration from Legacy Database user management. User migration via custom authentication extensions. Read more

Does Microsoft Entra External ID support Self-Service Profile Management Portal user management?

Microsoft Entra External ID supports Self-Service Profile Management Portal user management. Self-service profile management via the My Account portal. Read more

Does Microsoft Entra External ID support User Account Linking user management?

Microsoft Entra External ID partially supports User Account Linking user management. Identity linking between local and federated accounts.

Does Microsoft Entra External ID support User Blocking / Banning user management?

Microsoft Entra External ID supports User Blocking / Banning user management.

Does Microsoft Entra External ID support User Metadata user management?

Microsoft Entra External ID supports User Metadata user management. Custom user attributes via Microsoft Graph extensionAttributes. Read more

Does Microsoft Entra External ID support Application Metadata user management?

Microsoft Entra External ID supports Application Metadata user management.

Does Microsoft Entra External ID support User Search user management?

Microsoft Entra External ID supports User Search user management. Full-featured user search via Microsoft Graph API. Read more

Does Microsoft Entra External ID support Role-Based Access Control (RBAC) user management?

Microsoft Entra External ID supports Role-Based Access Control (RBAC) user management. Read more

Does Microsoft Entra External ID support Organizations (Multi-Tenancy B2B) user management?

Microsoft Entra External ID partially supports Organizations (Multi-Tenancy B2B) user management. Multi-tenancy via separate external tenants. No built-in B2B organization abstraction within a tenant. Read more

Does Microsoft Entra External ID support Password Strength Policies user management?

Microsoft Entra External ID supports Password Strength Policies user management. Read more

Does Microsoft Entra External ID support Username Restrictions user management?

Microsoft Entra External ID supports Username Restrictions user management. Username (alias) sign-in is available. Flexible regex-based validation — default accepts any string that doesn't look like an email; custom regex patterns configurable via admin center or Graph API. Username must be unique and cannot match email format. Read more

Does Microsoft Entra External ID support Progressive Profiling / Forms user management?

Microsoft Entra External ID partially supports Progressive Profiling / Forms user management. Progressive profiling via custom user flows. Read more

Does Microsoft Entra External ID support Attribute-Based Access Control (ABAC) access control?

Microsoft Entra External ID partially supports Attribute-Based Access Control (ABAC) access control. Attribute-based access control via Conditional Access policies. Read more

Does Microsoft Entra External ID support Fine-Grained Authorization (FGA / ReBAC) access control?

Microsoft Entra External ID does not support Fine-Grained Authorization (FGA / ReBAC) access control.

Does Microsoft Entra External ID support API Authorization (Scopes / Permissions) access control?

Microsoft Entra External ID supports API Authorization (Scopes / Permissions) access control. Read more

Does Microsoft Entra External ID support Audit Log Retention security feature?

Microsoft Entra External ID supports Audit Log Retention security feature. Read more

Does Microsoft Entra External ID support Audit Log Streaming security feature?

Microsoft Entra External ID supports Audit Log Streaming security feature. Stream to Azure Monitor, Azure Event Hubs, and Azure Log Analytics. Read more

Does Microsoft Entra External ID support Security Center (Threat Monitoring Dashboard) security feature?

Microsoft Entra External ID supports Security Center (Threat Monitoring Dashboard) security feature. Microsoft Entra ID Protection provides threat monitoring. Read more

Does Microsoft Entra External ID support Encryption at Rest security feature?

Microsoft Entra External ID supports Encryption at Rest security feature.

Does Microsoft Entra External ID support Encryption in Transit security feature?

Microsoft Entra External ID supports Encryption in Transit security feature.

Does Microsoft Entra External ID support Customer Managed Keys (BYOK) security feature?

Microsoft Entra External ID does not support Customer Managed Keys (BYOK) security feature. Customer-managed keys are not available for External ID external tenant data.

Does Microsoft Entra External ID support Bot Detection security feature?

Microsoft Entra External ID supports Bot Detection security feature. Bot detection via Cloudflare WAF and Akamai WAF partner integrations. Provides DDoS protection, bot detection, and OWASP Top 10 filtering. Read more

Does Microsoft Entra External ID support Brute Force Protection security feature?

Microsoft Entra External ID supports Brute Force Protection security feature. Smart Lockout protects against brute force attacks. Read more

Does Microsoft Entra External ID support Suspicious IP Throttling security feature?

Microsoft Entra External ID supports Suspicious IP Throttling security feature. IP-based risk detection via Conditional Access. Read more

Does Microsoft Entra External ID support Breached Password Detection security feature?

Microsoft Entra External ID partially supports Breached Password Detection security feature. Password ban list against known weak/breached passwords. Read more

Does Microsoft Entra External ID support Credential Guard (Dark Web Monitoring) security feature?

Microsoft Entra External ID does not support Credential Guard (Dark Web Monitoring) security feature. Microsoft Entra ID Protection (which includes leaked credential detection) is explicitly not available for external tenants.

Does Microsoft Entra External ID support Tenant Access Control List (IP ACL) security feature?

Microsoft Entra External ID partially supports Tenant Access Control List (IP ACL) security feature. IP-based location conditions are available in Conditional Access for external tenants. WAF integration (Cloudflare, Akamai) provides additional network-level ACL. Not a native tenant ACL feature. Read more

Does Microsoft Entra External ID support Device Fingerprinting security feature?

Microsoft Entra External ID partially supports Device Fingerprinting security feature. Device compliance and registration via Microsoft Intune integration. Read more

Does Microsoft Entra External ID support Per-Organization Branding multi-tenancy?

Microsoft Entra External ID supports Per-Organization Branding multi-tenancy. Per-tenant company branding with logo, background, and colors. Read more

Does Microsoft Entra External ID support Per-Organization MFA Policy multi-tenancy?

Microsoft Entra External ID supports Per-Organization MFA Policy multi-tenancy. Per-tenant MFA enforcement via Conditional Access policies. Read more

Does Microsoft Entra External ID support Hosted / Universal Login Page branding feature?

Microsoft Entra External ID supports Hosted / Universal Login Page branding feature. Read more

Does Microsoft Entra External ID support Embedded / Native Login Components branding feature?

Microsoft Entra External ID supports Embedded / Native Login Components branding feature. Native Authentication SDK for iOS and Android enables embedded login without redirects. Read more

Does Microsoft Entra External ID support White-Label / Full Brand Removal branding feature?

Microsoft Entra External ID supports White-Label / Full Brand Removal branding feature. Full brand customization with custom domain and Microsoft branding removed. Read more

Does Microsoft Entra External ID support Localization / i18n branding feature?

Microsoft Entra External ID supports Localization / i18n branding feature. Support for 40+ languages in hosted login pages. Read more

Does Microsoft Entra External ID support Prebuilt UI Components (SDK) branding feature?

Microsoft Entra External ID supports Prebuilt UI Components (SDK) branding feature. MSAL SDKs and Microsoft-hosted UX components. Read more

Does Microsoft Entra External ID support Login / Auth Analytics Dashboard analytics?

Microsoft Entra External ID supports Login / Auth Analytics Dashboard analytics. Sign-in logs and usage reports via Azure Monitor. Read more

Does Microsoft Entra External ID support SOC 2 Type II Certification compliance?

Microsoft Entra External ID supports SOC 2 Type II Certification compliance. Read more

Does Microsoft Entra External ID support ISO 27001 / 27017 / 27018 Certification compliance?

Microsoft Entra External ID supports ISO 27001 / 27017 / 27018 Certification compliance.

Does Microsoft Entra External ID support HIPAA Business Associate Agreement (BAA) compliance?

Microsoft Entra External ID supports HIPAA Business Associate Agreement (BAA) compliance. Read more

Does Microsoft Entra External ID support PCI DSS Compliance compliance?

Microsoft Entra External ID supports PCI DSS Compliance compliance.

Does Microsoft Entra External ID support CSA STAR Certification compliance?

Microsoft Entra External ID supports CSA STAR Certification compliance.

Does Microsoft Entra External ID support FedRAMP Authorization compliance?

Microsoft Entra External ID supports FedRAMP Authorization compliance. Microsoft Azure holds FedRAMP High authorization. Read more

Does Microsoft Entra External ID support GDPR: Data Export (Portability) compliance?

Microsoft Entra External ID supports GDPR: Data Export (Portability) compliance. Read more

Does Microsoft Entra External ID support GDPR: Right to be Forgotten (User Deletion) compliance?

Microsoft Entra External ID supports GDPR: Right to be Forgotten (User Deletion) compliance.

Does Microsoft Entra External ID support Consent Management compliance?

Microsoft Entra External ID partially supports Consent Management compliance. OAuth 2.0 consent framework for app permissions. Read more

Does Microsoft Entra External ID support Region Deployment compliance?

Microsoft Entra External ID supports Region Deployment compliance. Multiple Azure regions; additional geo options (AU, JP) as add-ons. Read more

Does Microsoft Entra External ID support Private Cloud Deployment compliance?

Microsoft Entra External ID supports Private Cloud Deployment compliance. Azure Government and sovereign cloud deployments available. Read more

Does Microsoft Entra External ID support SDK Coverage developer integration?

Microsoft Entra External ID supports SDK Coverage developer integration. MSAL libraries for .NET, Java, JavaScript, Python, iOS, Android, Go, and more. Read more

Does Microsoft Entra External ID support Management API developer integration?

Microsoft Entra External ID supports Management API developer integration. Full Microsoft Graph API for identity management. Read more

Does Microsoft Entra External ID support Authentication API Rate Limits developer integration?

Microsoft Entra External ID supports Authentication API Rate Limits developer integration. Documented limits: 200 req/s per tenant, 20 req/s per IP. Token issuance varies by flow (sign-up: 6 requests, sign-in: 4). Telephony: 100 SMS per IP per 15 min, 500 per tenant per 15 min. Read more

Does Microsoft Entra External ID support Actions / Extensibility Pipeline developer integration?

Microsoft Entra External ID partially supports Actions / Extensibility Pipeline developer integration. Custom authentication extensions via REST API calls at specific points in the flow. Read more

Does Microsoft Entra External ID support TypeScript Support in Extensibility developer integration?

Microsoft Entra External ID supports TypeScript Support in Extensibility developer integration. Custom extensions are REST APIs — any language including TypeScript supported.

Does Microsoft Entra External ID support Custom Domain developer integration?

Microsoft Entra External ID supports Custom Domain developer integration. Read more

Does Microsoft Entra External ID support Deploy CLI (Infrastructure as Code) developer integration?

Microsoft Entra External ID does not support Deploy CLI (Infrastructure as Code) developer integration. No dedicated deploy CLI for External ID. Configuration is managed via Microsoft Entra admin center, Azure CLI, Microsoft Graph API, or PowerShell.

Does Microsoft Entra External ID support Terraform Provider developer integration?

Microsoft Entra External ID supports Terraform Provider developer integration. AzureRM and AzureAD Terraform providers cover Entra resources. Read more

Does Microsoft Entra External ID support Custom Database Connections developer integration?

Microsoft Entra External ID does not support Custom Database Connections developer integration.

Does Microsoft Entra External ID support Native Webhook Support developer integration?

Microsoft Entra External ID partially supports Native Webhook Support developer integration. REST API connectors in user flows fire HTTP calls at specific points in the auth flow. Read more

Does Microsoft Entra External ID support Universal Login / Hosted Login Page Customization developer integration?

Microsoft Entra External ID supports Universal Login / Hosted Login Page Customization developer integration. Fully customizable company branding for login pages. Read more

Does Microsoft Entra External ID support Custom Email Provider (SMTP) developer integration?

Microsoft Entra External ID supports Custom Email Provider (SMTP) developer integration. Custom email provider via the emailOtpSend custom authentication extension event. Supports any email provider (Azure Communication Services, SendGrid, etc.). Read more

Does Microsoft Entra External ID support Email Templates developer integration?

Microsoft Entra External ID supports Email Templates developer integration. Read more

Does Microsoft Entra External ID support Custom OIDC Claims / Token Enrichment developer integration?

Microsoft Entra External ID supports Custom OIDC Claims / Token Enrichment developer integration. Custom claims mapping via optional claims and custom authentication extensions. Read more

Does Microsoft Entra External ID support No-Code Auth Flow Builder / Orchestration feature?

Microsoft Entra External ID does not support No-Code Auth Flow Builder / Orchestration feature.

Does Microsoft Entra External ID support Identity Verification / Document Proofing feature?

Microsoft Entra External ID does not support Identity Verification / Document Proofing feature.

Does Microsoft Entra External ID support Decentralized / Verifiable Credentials feature?

Microsoft Entra External ID partially supports Decentralized / Verifiable Credentials feature. Microsoft Entra Verified ID is a separate service for W3C Verifiable Credentials. Read more

Does Microsoft Entra External ID support Built-in Billing / Subscription Management feature?

Microsoft Entra External ID does not support Built-in Billing / Subscription Management feature.

Does Microsoft Entra External ID support Agentic AI / MCP Server Authentication feature?

Microsoft Entra External ID partially supports Agentic AI / MCP Server Authentication feature. Microsoft Entra Agent ID (Preview, announced Ignite 2025) provides first-class identity constructs for AI agents: OAuth 2.0 client credentials and on-behalf-of flows, lifecycle management, Conditional Access for agents, and Identity Protection. Read more

Note: The current data is based on provider documentation/experience and may not be 100% accurate. Please open an issue if you have spotted any inconsistencies.