This chapter covers External Identities, Microsoft Entra ID's capability for managing access for people outside an organization. AZ-900 tests this under objective 2.5, extending the identity concepts covered in earlier chapters.
Jump to a section
A simple way to picture External Identities in Azure
When a visiting contractor or partner needs to attend a meeting, an organization doesn't necessarily issue them a full employee badge — they might issue a guest pass, or let the visitor use credentials they already have from their own employer. External Identities in Azure work the same way: they let people outside an organization (partners, contractors, customers) access resources without requiring the organization to create a brand-new managed identity for every single external person.
What External Identities covers
External Identities is Microsoft Entra ID's set of capabilities for managing access for users outside an organization — business partners, contractors, or customers — rather than only supporting an organization's own internal employees.
Business-to-business (B2B) collaboration
One common scenario is B2B collaboration, where an external partner can be invited to access specific resources using their own existing identity (from their own organization), rather than the inviting organization creating and managing a brand-new separate account for that person.
Business-to-customer (B2C) scenarios
A related but distinct scenario is customer-facing identity, where an organization needs to manage sign-in for external customers accessing a customer-facing application — a different need from managing internal employee or partner access.
Why this distinction matters
Without External Identities capabilities, an organization would need to create and fully manage a separate internal-style account for every external partner or customer needing access — extra administrative overhead and a weaker security model than letting external users authenticate with their own existing identity where appropriate.
Identify the external access need
Determine whether the scenario is B2B (a partner or contractor needing access to internal resources) or B2C (a customer needing to sign into a customer-facing application).
Invite or configure external access
For B2B, external users can be invited to collaborate using their own existing identity. For B2C, sign-in capabilities are configured for the customer-facing application.
Manage access appropriately
External users are granted only the access appropriate to their role, distinct from full internal employee access.
A company collaborating with an external consulting partner invites specific individuals from that partner organization to access a shared project resource using their own existing work identity, rather than creating and managing new internal accounts for each consultant.
Objective 2.5 expects recognition of External Identities as covering access for people outside an organization, distinguishing B2B (partner/contractor access) from B2C (customer-facing sign-in) scenarios.
A common wrong answer is assuming all identity management in Azure is only for an organization's own internal employees — External Identities specifically extends identity management to external partners and customers.
Stable terms: External Identities, B2B, B2C. Memory trick: B2B = inviting an outside partner to use their own identity to collaborate. B2C = managing sign-in for your own customer-facing application.
External Identities is Microsoft Entra ID's capability for managing access for people outside an organization.
B2B collaboration lets external partners access resources using their own existing identity.
B2C scenarios cover managing sign-in for an organization's own external customers, a distinct need from B2B.
These come up on the exam all the time. Here's how to tell them apart.
B2B (Business-to-Business)
External partners/contractors collaborating on internal resources
Often uses the partner's own existing identity
B2C (Business-to-Customer)
Customers signing into a customer-facing application
Identity managed specifically for that application's users
Mistake
Azure identity management only covers an organization's own internal employees.
Correct
External Identities capabilities extend identity and access management to external partners, contractors, and customers as well, not just internal staff.
Mistake
B2B and B2C scenarios are the same thing.
Correct
B2B covers inviting external partners/contractors to collaborate using their own existing identity; B2C covers managing sign-in for an organization's own external customers — different scenarios with different needs.
They're Microsoft Entra ID capabilities for managing access for people outside an organization — business partners, contractors, or customers — rather than only supporting internal employees.
B2B (business-to-business) covers inviting external partners or contractors to access resources, often using their own existing identity. B2C (business-to-customer) covers managing sign-in for an organization's own customer-facing application — a distinct scenario.
You've just covered External Identities in Azure — now see how well it sticks with free AZ-900 practice questions. Full explanations included, no account needed.
Done with this chapter?