For consumer and business-customer applications, External ID uses a separate Microsoft Entra tenant set up in its external configuration, distinct from the workforce tenant where staff accounts live.
Read more: Microsoft Learn
In the Ultra Transcenders books
Each book explains External tenant in context, with comparison tables and the common traps.
Terms in this definition
- External
API Management virtual network mode in which the gateway stays public but can call private back ends inside the VNet.
- Microsoft Entra tenant
Instance of the Entra ID directory dedicated to an organisation, with an initial .onmicrosoft.com domain picked when it is created. Every Azure subscription trusts one tenant only.
- Set
Secret permission in Key Vault for writing secrets; some older material refers to it as Create.
- Workforce tenant
Used for a company's staff and its own resources, whereas external tenants hold customer identities. When created as a governed workforce tenant, it is linked back to the home tenant through a governance relationship.
- WHERE
Limits a SELECT, UPDATE or DELETE to just the rows meeting a condition. Omit it, and the statement hits every row.
- AGDLP
Nesting pattern: users go into global groups, which go into domain local groups, which receive the permissions. AGUDLP adds universal groups for forests with several domains.
Related terms
- B2C
Microsoft stopped selling Azure AD B2C to new customers on 1 May 2025. It was the older customer identity (CIAM) offering, now succeeded by Microsoft Entra External ID running in an external tenant.
- CIAM
Customer identity and access management lets a business's customers and consumers create accounts, sign in and manage their profiles. Microsoft's offering is Microsoft Entra External ID, run in an external tenant.