# External Identities in Azure

> Chapter 135 of the Courseiva AZ-900 curriculum — https://courseiva.com/learn/az-900/external-identities

**Official objective:** 2.5 — Describe identity, access, and security

## Introduction

This chapter covers External Identities, Microsoft Entra ID's capability for managing access for people outside an organization. AZ-900 tests this under objective 2.5, extending the identity concepts covered in earlier chapters.

## Guest Access, Not a New Employee Badge

When a visiting contractor or partner needs to attend a meeting, an organization doesn't necessarily issue them a full employee badge — they might issue a guest pass, or let the visitor use credentials they already have from their own employer. External Identities in Azure work the same way: they let people outside an organization (partners, contractors, customers) access resources without requiring the organization to create a brand-new managed identity for every single external person.

## Core explanation

### What External Identities covers
External Identities is Microsoft Entra ID's set of capabilities for managing access for users outside an organization — business partners, contractors, or customers — rather than only supporting an organization's own internal employees.

### Business-to-business (B2B) collaboration
One common scenario is B2B collaboration, where an external partner can be invited to access specific resources using their own existing identity (from their own organization), rather than the inviting organization creating and managing a brand-new separate account for that person.

### Business-to-customer (B2C) scenarios
A related but distinct scenario is customer-facing identity, where an organization needs to manage sign-in for external customers accessing a customer-facing application — a different need from managing internal employee or partner access.

### Why this distinction matters
Without External Identities capabilities, an organization would need to create and fully manage a separate internal-style account for every external partner or customer needing access — extra administrative overhead and a weaker security model than letting external users authenticate with their own existing identity where appropriate.

## Real-world context

A company collaborating with an external consulting partner invites specific individuals from that partner organization to access a shared project resource using their own existing work identity, rather than creating and managing new internal accounts for each consultant.

## Exam focus

Objective 2.5 expects recognition of External Identities as covering access for people outside an organization, distinguishing B2B (partner/contractor access) from B2C (customer-facing sign-in) scenarios.

A common wrong answer is assuming all identity management in Azure is only for an organization's own internal employees — External Identities specifically extends identity management to external partners and customers.

Stable terms: **External Identities**, **B2B**, **B2C**. Memory trick: B2B = inviting an outside partner to use their own identity to collaborate. B2C = managing sign-in for your own customer-facing application.

## Step by step

1. **Identify the external access need** — Determine whether the scenario is B2B (a partner or contractor needing access to internal resources) or B2C (a customer needing to sign into a customer-facing application).
2. **Invite or configure external access** — For B2B, external users can be invited to collaborate using their own existing identity. For B2C, sign-in capabilities are configured for the customer-facing application.
3. **Manage access appropriately** — External users are granted only the access appropriate to their role, distinct from full internal employee access.

## Comparisons

### B2B (Business-to-Business) vs B2C (Business-to-Customer)

**B2B (Business-to-Business):**
- External partners/contractors collaborating on internal resources
- Often uses the partner's own existing identity

**B2C (Business-to-Customer):**
- Customers signing into a customer-facing application
- Identity managed specifically for that application's users

## Common misconceptions

- **Misconception:** Azure identity management only covers an organization's own internal employees. **Reality:** External Identities capabilities extend identity and access management to external partners, contractors, and customers as well, not just internal staff.
- **Misconception:** B2B and B2C scenarios are the same thing. **Reality:** B2B covers inviting external partners/contractors to collaborate using their own existing identity; B2C covers managing sign-in for an organization's own external customers — different scenarios with different needs.

## Key takeaways

- External Identities is Microsoft Entra ID's capability for managing access for people outside an organization.
- B2B collaboration lets external partners access resources using their own existing identity.
- B2C scenarios cover managing sign-in for an organization's own external customers, a distinct need from B2B.

## FAQ

**What are External Identities in Azure?**

They're Microsoft Entra ID capabilities for managing access for people outside an organization — business partners, contractors, or customers — rather than only supporting internal employees.

**What's the difference between B2B and B2C?**

B2B (business-to-business) covers inviting external partners or contractors to access resources, often using their own existing identity. B2C (business-to-customer) covers managing sign-in for an organization's own customer-facing application — a distinct scenario.

---

Interactive version with quiz and diagrams: https://courseiva.com/learn/az-900/external-identities