Topic starter
11/07/2026 2:00 pm
TL;DR: Azure AD B2C is no longer open to new customers and Microsoft has shifted new feature development to Entra External ID, creating a migration path that spans tenant setup, user migration, app reconfiguration, and authentication redesign, according to Authsignal. The practical issue is not just moving identities, but deciding which auth controls belong in the CIAM layer versus a dedicated authentication layer.
Editorial analysis by NHI Mgmt Group, based on content published by Authsignal: “How to migrate from Azure AD B2C to Microsoft Entra External ID”.
Key questions
Q: What breaks when Azure AD B2C custom policies cannot be carried forward as-is?
A: Teams lose the ability to reuse embedded login logic, exception handling, and step-up flows exactly as they existed before.
Q: When should teams prioritise external authorization over relying on authentication alone in CIAM?
A: Teams should prioritise external authorisation when authentication proves who the customer is but not whether the requested access still makes sense.
Q: What are the main failure modes in a JIT user migration to Entra External ID?
A: The main failure modes are password policy mismatch, incomplete exception handling, and assuming the migration flag alone proves successful migration.
Practitioner guidance
- Audit B2C policy dependencies Inventory every user flow, custom policy, identity provider, API connector, application registration, user attribute, and MFA setting before planning the move.
- Separate migration from authentication redesign Decide which current controls must be preserved, which should be rebuilt, and which belong in a dedicated authentication provider rather than the CIAM layer.
- Test the JIT migration path end to end Validate the export, import, and Azure Function sequence against password policy, account flags, and exception handling before cutting over production users.
Bottom line: Azure AD B2C migration to Entra External ID is as much about redefining control boundaries as it is about moving tenants and users.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/07/2026 2:11 pm
Migration is exposing a control-boundary problem, not just a platform-change problem. The article shows that teams are not only moving users and app registrations. They are deciding where authentication assurance lives, which is a governance decision with architectural consequences. That is especially important in CIAM programmes where the login experience, risk checks, and identity directory have historically been bundled together. Practitioners should treat the migration as a boundary-setting exercise for the whole identity stack.
A question worth separating out:
Q: How do IAM teams evaluate whether Azure AD B2C and Entra External ID do the same job?
A: They do not do the same job in exactly the same way. Entra External ID is the migration target for customer identity management, but the article shows that advanced authentication capabilities may need to move outside the CIAM platform, so teams should compare control boundaries rather than feature lists.
👉 Read our full editorial: Azure AD B2C to Entra External ID migration and auth tradeoffs