Describe external identities and guest access in Azure

External identities in Azure refer to individuals who are not directly part of your organization’s Azure Active Directory (Azure AD) but need access to your organization’s resources. These external users can include partners, suppliers, customers, or consultants. Azure supports external identities through various features that enable secure collaboration while maintaining control over your company’s data and resources.

Azure Active Directory B2B (Business-to-Business)

Through Azure AD B2B collaboration, external users can access your corporate resources by either being directly invited or by using their own credentials from another identity provider such as Google, Facebook, or another Azure AD. This service allows guests to be authenticated without the need for a Microsoft Account or other pre-existing credentials.

When a guest is added to your Azure AD, a new guest user account is created. This account provides access to resources in a similar manner to how internal users are granted access, but with the ability to apply specific policies tailored for external users.

Here are some key features of Azure AD B2B Collaboration:

• Invitation Process: Internal users or administrators can invite guests through email, which includes a redemption process for the guest to access resources.

• Authentication: External users authenticate using their own credentials, with optional multi-factor authentication for enhanced security.

• Conditional Access Policies: Specify conditions for guest access, including locations, device compliance, or risk-based conditions.

• Auditing and Reporting: Track guest user sign-ins and activities within the Azure AD portal.

Azure Active Directory B2C (Business-to-Consumer)

Azure AD B2C is a comprehensive identity management service for consumer-facing applications. It is different from B2B because it’s focused on applications with external customers rather than collaboration with external business users.

Azure AD B2C features include:

• Custom User Experience: Fully customizable user interfaces for sign-up, sign-in, and profile management.

• Identity Providers: Allow users to log in with their preferred social accounts or custom identity providers.

• Advanced Policies: Control how users interact with your applications, including password complexity, sign-in, and sign-up flows.

Guest Access Examples:

1. Collaborating with a Supplier: You might need to collaborate with a supplier who requires access to a portion of your Azure portal for uploading documentation or monitoring supply chain analytics. Using Azure AD B2B, you can invite a user from the supplier to access the specific Azure resources needed without creating company accounts for them.

2. Customer Access to a Web App: Using Azure AD B2C, you can allow customers to sign up for your web application using their existing social accounts or personal emails. This provides a seamless experience for them and leverages Azure’s secure authentication mechanisms for your app.

Comparative Table between Azure AD B2B and Azure AD B2C:

Security remains at the forefront of both Azure AD B2B and Azure AD B2C. While they each cater to different kinds of external identities, they both ensure that proper security measures such as multi-factor authentication (MFA) and conditional access policies can be applied to safeguard resources and provide secure access.

In Azure AD B2B, once a guest user has access, they appear alongside internal users in the directory, making it easier for internal users to find and collaborate with them. This seamless integration is a cornerstone of Azure’s philosophy on enabling collaboration without compromising security.

Both Azure AD B2B and Azure AD B2C exemplify Microsoft Azure’s capabilities in managing external identities and ensuring guest access is both streamlined and secure, aligning with various organizational requirements and scenarios.