entra-external-id
starsforks
How to install entra-external-id?
vinayaklatthe/microsoft-security-skills/entra-external-id
$npx -y skills add vinayaklatthe/microsoft-security-skills --skill entra-external-idGuidance for Microsoft Entra External ID — the unified customer identity and access management (CIAM) and external collaboration platform that replaces Azure AD B2C (for new tenants) and consolidates B2B guest scenarios. Covers external tenant creation, user flows (sign-up/sign-i
SKILL.md
| 1 | # Microsoft Entra External ID |
| 2 | |
| 3 | Entra External ID is Microsoft's unified platform for **identities outside your |
| 4 | workforce**: |
| 5 | |
| 6 | - **Customer identity (CIAM)** in a dedicated **external tenant** — successor to Azure AD |
| 7 | B2C for new deployments. |
| 8 | - **Business partner collaboration (B2B)** in your **workforce tenant** — guests, B2B |
| 9 | direct connect, cross-tenant access settings. |
| 10 | |
| 11 | Both are managed in the same admin surface and use the same Conditional Access engine. |
| 12 | |
| 13 | ## When to use |
| 14 | - Authenticating customers / consumers into your apps with social or email sign-up. |
| 15 | - Replacing Azure AD B2C (Microsoft's stated path for new CIAM deployments). |
| 16 | - Inviting and governing external partners as B2B guests with Conditional Access. |
| 17 | - Configuring cross-tenant access for federated partner organizations. |
| 18 | |
| 19 | **Do not use this skill** for employee identity (`entra-id`), workforce lifecycle |
| 20 | governance (`entra-id-governance`), or workforce CA policy authoring |
| 21 | (`conditional-access-mfa`). |
| 22 | |
| 23 | ## External tenant vs workforce tenant — choose first |
| 24 | |
| 25 | | Scenario | Tenant type | |
| 26 | |---|---| |
| 27 | | Public-facing consumer app, social/email sign-up, custom-branded sign-in | **External tenant** (CIAM) | |
| 28 | | Partner companies' employees collaborating in Teams/SharePoint/Apps | **Workforce tenant** (B2B guests, cross-tenant access) | |
| 29 | | Both | **Separate** external tenant + your existing workforce tenant | |
| 30 | |
| 31 | > **Rule of thumb:** never mix customers and employees in the same workforce tenant — |
| 32 | > licensing, branding, lifecycle, and CA scoping all diverge fast. |
| 33 | |
| 34 | ## Approach |
| 35 | |
| 36 | ### External tenant (CIAM) |
| 37 | |
| 38 | 1. **Create the external tenant** (separate from your workforce tenant). Pick region; |
| 39 | data residency is tenant-fixed. |
| 40 | |
| 41 | 2. **Register your customer app** in the external tenant. SDKs: MSAL for web/SPA/mobile, |
| 42 | plus native integrations. |
| 43 | |
| 44 | 3. **Author user flows.** Built-in flows cover the common cases: sign-up/sign-in, password |
| 45 | reset, profile edit. Configure: |
| 46 | - Identity providers (email + password, email OTP, Google, Facebook, Apple, generic |
| 47 | OIDC, SAML). |
| 48 | - **Passkey support** (preview/GA per region) — passwordless from day one. |
| 49 | - Custom attributes you want to collect. |
| 50 | - Branding (logo, colors, custom CSS/HTML for sign-in page). |
| 51 | |
| 52 | 4. **Custom authentication extensions** replace the old B2C custom-policy XML model. |
| 53 | Two flavors: |
| 54 | - **Token issuance start** — call an external API at sign-in to enrich claims |
| 55 | (e.g., look up loyalty tier from your CRM). |
| 56 | - **Attribute collection / submit** — call an API during sign-up to validate or |
| 57 | enrich the new user (e.g., third-party identity verification). |
| 58 | |
| 59 | 5. **Conditional Access for external users.** Apply CA policies in the external tenant |
| 60 | — risk-based MFA, device platform restrictions, blocked countries. CA for external |
| 61 | tenants is included. |
| 62 | |
| 63 | 6. **Migration from Azure AD B2C** — there's no in-place upgrade. Plan: |
| 64 | - Re-create app registrations and user flows in External ID. |
| 65 | - Bulk migrate users via Microsoft Graph (passwords cannot be exported; users |
| 66 | reset on first sign-in or you stage migration via just-in-time JIT migration). |
| 67 | - Run B2C and External ID in parallel during migration; cut over per app. |
| 68 | |
| 69 | ### Workforce tenant (B2B collaboration) |
| 70 | |
| 71 | 1. **Cross-tenant access settings** — for each partner tenant decide: |
| 72 | - **B2B collaboration**: invite their users as guests in your tenant. |
| 73 | - **B2B direct connect**: their users access via Teams Shared Channels without being |
| 74 | guests in your tenant (today: Teams + selected resources). |
| 75 | - Inbound MFA trust: trust the partner's MFA claim, don't re-prompt. |
| 76 | - Outbound restrictions: limit what your users can do in their tenant. |
| 77 | |
| 78 | 2. **Default policy is permissive.** Tighte |
People who liked this also viewed
6 picksType
- entra-app-registrationGuides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API perSkillsJul 2026
- azure-complianceRun Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: SkillsJul 2026
- azure-rbacOfficial agent plugin providing skills and MCP server configurations for Azure scenarios.SkillsJul 2026
- better-auth-best-practicesAgent skill from better-auth/skillsSkillsJul 2026
- firebase-security-rules-auditorA skill to evaluate how secure Firestore security rules are. Use this when Firestore security rules are updated to ensure that the generated rules are extremely secure and robust.SkillsJul 2026
- audit-websiteAudit a website with the squirrelscan CLI and fix the findings in code. Runs SEO, performance, security, technical, content, accessibility, and 15 other rule categories (260+ rules), returns an LLM-opSkillsJul 2026
