Entra External ID: B2B vs B2C explained
Microsoft Entra External ID is the umbrella for everything that involves people outside your organization. The decision rule: if your own workforce needs to share apps and resources with partner users, use B2B collaboration in your workforce tenant; if you are publishing an app to consumers or business customers, use an external tenant. Azure AD B2C, the older customer-identity product, is no longer sold to new customers, so new designs use External ID. Exam outlines test the guest and cross-tenant side far more than B2C.
Two jobs, two tenant configurations
Microsoft Learn describes two tenant configurations. They are both Microsoft Entra tenants, configured differently.
| Workforce tenant (B2B) | External tenant (customer identity) | |
|---|---|---|
| Who signs in | Business partners, suppliers, vendors as guests | Consumers and business customers of your app |
| Where they live | Same directory as your employees, as user objects | A separate directory, apart from employees |
| What they reach | Microsoft 365, SaaS and line-of-business apps, SSO to any Entra-connected app | Apps registered in the external tenant; no SSO to Microsoft 365 |
| Onboarding | Invitation, self-service sign-up, or entitlement management | Self-service sign-up and sign-in user flows with your branding |
| Created in | Azure portal or Entra admin center | Entra admin center only |
| Entitlement management | Supported | Not applicable |
The B2B side is also where Teams shared channels fit: B2B direct connect is a two-way trust between two Entra organizations in which users sign in at home and are not added as guests in your directory. Cross-tenant access settings block it by default; both sides must enable it.
Where B2C stands today
Per Microsoft Learn, as of May 1, 2025 Azure AD B2C is not available to purchase for new customers. Current customers can keep using it, and Microsoft says it will support B2C until at least May 2030. The B2C Premium P2 tier was discontinued on March 15, 2026, with B2C tenants switched to P1. Microsoft calls External ID the next-generation CIAM solution, where new features are built, and documents a migration path. Custom policies (the Identity Experience Framework) cannot be moved one to one; their logic must be rebuilt with custom authentication extensions.
Exam impact. None of the 45 official outlines tracked on this site names Azure AD B2C. The outlines that touch the area say “external users” or “external identities”, so treat B2C as background: know it is the legacy, separate-directory product that is now closed to new customers.
What a B2B guest looks like in your directory
Take John at contoso.com, invited to the Fabrikam tenant.
- A user object is created in Fabrikam’s directory as soon as the invitation is sent, with no credentials. The invitation state is Pending acceptance.
- After redemption, the Identities property shows how John signs in: ExternalAzureAD for another Entra tenant, Microsoft account, google.com, or “mail” for email one-time passcode.
- The UPN follows the pattern
john_contoso.com#EXT#@fabrikam.onmicrosoft.com. - UserType is typically Guest. Identities and UserType are independent properties; a guest can also be flagged Member, which is common between tenants of one multi-tenant organization.
Email one-time passcode is on by default for new tenants. Guests have restricted directory permissions by default, and an admin can raise them. For billing, External ID uses monthly active users, and guests of workforce tenants are counted when their UserType is Guest. The tenant must be linked to an Azure subscription.
The controls exams keep asking about
- External collaboration settings decide who may invite guests and which domains are allowed or blocked.
- Cross-tenant access settings (default and per-organization, inbound and outbound) decide whether users can authenticate with specific Entra tenants, and whether to trust their MFA and device claims. Trusting MFA claims avoids a second prompt. Trust settings and per-user scoping need Entra ID P1.
- When both apply, the most restrictive wins. A blocked domain stops new invitations to that domain even if cross-tenant access allows B2B; existing guests from it keep working.
- Cross-tenant synchronization provisions users between tenants of one organization without invitation emails. See Hybrid identity for the other sync products.
- Entitlement management controls guest access at scale and removes expired guests; see access reviews and entitlement management.
- Conditional Access applies to guests like employees; see Conditional Access explained.
- External identity providers can federate with SAML or WS-Fed.
Which exams test this
| Exam | How it appears | Where on this site |
|---|---|---|
| SC-300 | Implement and manage user identities (20 to 25%): external collaboration settings, inviting external users singly or in bulk, managing external accounts, cross-tenant access settings, cross-tenant synchronization, external identity providers (SAML, WS-Fed). Governance (20 to 25%): lifecycle of external users, connected organizations. Outline applies from October 28, 2026 | User identities explained, Identity governance explained |
| AZ-104 | Manage Azure identities and governance (20 to 25%): manage external users | Identities and governance explained |
| AZ-900 | Azure architecture and services (35 to 40%): describe external identities in Azure (high-level, definition only) | Architecture and services explained |
How the questions are built
- “Partners need access to our SharePoint site and Teams group” means B2B collaboration with guest accounts.
- “Two tenants after an acquisition, no invitations” means cross-tenant synchronization.
- “Avoid double MFA for partner users” means inbound trust of MFA claims in cross-tenant access settings.
- “Shared channel in Teams without guest accounts” means B2B direct connect.
- “Customers sign up with Google, branded page, separate from staff” means an external tenant, not guests.
- “Who can invite” is external collaboration settings; “which organizations” is cross-tenant access settings. Mixing those two is the common trap. Related reading: SSO, SAML and OAuth.
Question 1. A retailer is building a new consumer mobile app. Shoppers will sign up with an email address or a Google account, the sign-in pages must carry the retailer's branding, and shopper accounts must be kept apart from the employee directory. What should the retailer create?
- A. B2B guest invitations in the workforce tenant
- B. A new Azure AD B2C tenant
- C. An external tenant in Microsoft Entra External ID
- D. B2B direct connect with each shopper
Show answer
Answer: C
An external tenant in Microsoft Entra External ID is the customer identity option for consumer apps, with its own directory, branded user flows and social sign-in. Inviting shoppers as B2B guests would put them in the workforce directory. Azure AD B2C is no longer available to new customers as of May 1, 2025. B2B direct connect is a trust between Entra organizations for Teams shared channels.
Question 2. Contoso's cross-tenant access settings allow B2B collaboration with all Microsoft Entra organizations. An admin then adds fabrikam.com to the blocked domains in the external collaboration settings. What is the result?
- A. Contoso users cannot invite new Fabrikam guests, but existing Fabrikam guests keep access
- B. All existing Fabrikam guests are deleted immediately
- C. Invitations to Fabrikam still work because cross-tenant access is more permissive
- D. Fabrikam users can now only connect through B2B direct connect
Show answer
Answer: A
The most restrictive setting applies. Blocking the domain stops Contoso users from inviting new Fabrikam guests, while guests who already exist can keep using B2B collaboration. Existing guests are not removed by this setting. The cross-tenant allow does not override the blocked domain. B2B direct connect is a separate feature and is not needed.