Confusion around B2B with Entra External ID for customers (CIAM)
Entra ID B2B has two parts to it:
- External ID for customers (CIAM) B2B
- Entra ID B2B
The confusion exists around the self-service sign-up user flow.
Entra ID B2B is the classic B2B where external users are added via an invite.
These users have a “User type” of “Guest” (as opposed to the usual “Member”) e.g.
or:
If you are in an Entra ID tenant and navigate to “External identities / User flows”:
you will see that the name starts with “B2X”, and one of the tabs is “API connectors”.
Refer to this for B2B collaboration.
If you are in an Entra External ID for customers (CIAM) tenant and navigate to “External identities / User flows”:
you will see that the name has no prefix, and one of the tabs is “Custom authentication extensions”.
Refer to this for CIAM.
Make sure you are in the right tenant 😄.
Self-service sign-up in the Entra ID tenant
In the Entra ID tenant, download one of the MSAL samples. I downloaded the .NET Core sample and used the single tenant one.
I created an app. registration for “My organisation only” and included returning an ID token.
I created a user flow with “Email OTP” and added some user attributes.
You need to link the user flow to the application:
In “External Collaboration Settings”, ensure self-service is turned on:
Run the application:
Click the “No account? Create one” link.
I entered a Gmail address. Click “Next”.
I entered the code and accepted the terms in the consent screen.
I was successfully logged in.
And I can then sign in with that guest account.
Conclusion: Self-service sign-up in an Entra ID tenant creates a Guest account.
Self-service sign-up in an Entra External ID for customers (CIAM) tenant
Remember: Access the portal via “entra.microsoft.com”.
I used this Microsoft.Identity.Web sample.
The config. is as per this post.
Click “No account? Create one”.
I used a Gmail address.
Enter the code and click “Next”.
Enter the details, click “Next”, and then accept the consent.
You are now signed in.
And I can then sign in with that account and password.
Conclusion: Self-service sign-up in an Entra External ID for customers (CIAM) tenant creates a Member account.
(In B2C terms, you can think of this as a “Local” account created by a B2C signup policy).
Notes
Note that the same user is now in both tenants.
In the Entra ID tenant, the UPN is:
user_gmail.com#EXT#@tenant.onmicrosoft.com
In the Entra External ID for customers tenant, the UPN is:
71c…2f4@tenant.onmicrosoft.com
What about invites in the Entra External ID for customers tenant?
The user is created as a Guest account.
Summary
All good!
