MSDEVBUILD / azure

External Identities

Your organisation🪪Microsoft Entra ID📊Project🛒ShopPartner (B2B guest)CustomerThey use their own accounts. You control what they can reach.
Partners and customers bring their own accounts. You decide what they can reach.

😟 THE PROBLEM

IT creates and forgets accounts for every partner, and customers need yet another password.

😊 THE SOLUTION

Use external identities: B2B guests and customer sign-in.

  • Creating accounts for partners✓ Invite them as B2B guests
  • Old partner accounts never removed✓ Access reviews
  • Customers need easy sign-up✓ External ID for customers
🛠️ Solved with: Microsoft Entra External ID
Module 2: Architecture & Services ⏱ 5 min read Updated 11 Nov 2026

Quick answer

External identities let people outside your organisation, such as partners, suppliers and customers, access your apps using their own identities (their work account, a Microsoft account, Google and others). B2B collaboration invites partners as guests. Microsoft Entra External ID lets customers sign up and sign in to your consumer-facing apps.

Exam objective: 2.4.3 Describe external identities in Azure. (Skills measured as of July 20, 2026)

Start with a question

A partner company needs access to one of your project apps. Do you give each of their people a new username and password?

You don’t have to. With external identities they sign in with the accounts they already have.

Explain it like I’m 10

The technical explanation

ScenarioFeatureWho
Partners use your internal appsB2B collaboration (guests)Suppliers, consultants
Shared Teams channels with another companyB2B direct connectPartner organisations
Customers sign up to your public appMicrosoft Entra External ID (customers)Consumers

Real-world business scenario

Enterprise

A construction company

The problem
Subcontractors needed access to a project portal; IT spent hours creating and deleting accounts.
What they used
Invited subcontractors as B2B guests with MFA and quarterly access reviews.
Why that choice
Partners use their own accounts; access is reviewed and removed automatically.
The result
Onboarding takes minutes, and stale accounts disappear after each review.

When to use it and when not to

✓ Use it when…

  • Partner collaboration.
  • Customer sign-in for public apps.

✕ Think twice when…

  • Creating internal accounts for outsiders.
Ready for more?The full lesson adds the technical explanation, when to use it, interview questions and revision notes.

Interview preparation

Say your answer out loud first, then open the model answer. Interviewers care more about your reasoning than the exact words.

Beginner What are external identities?

Model answer

A way for people outside my company, like partners or customers, to access my apps using their own accounts, so I don't have to create and manage passwords for them.

Intermediate What is the difference between B2B and customer identity?

Model answer

B2B collaboration is for partners working with your internal apps; they appear as guest users in your directory. Customer identity (Entra External ID for customers) is for consumers signing up to your public apps, at large scale, with custom branding and social sign-in.

Experienced developer How do you keep guest access under control?

Model answer

Use access reviews to remove stale guests, apply Conditional Access with MFA for guests, limit guest permissions and invitations, and use entitlement management access packages with expiry dates.

Test yourself with exercises

3 original practice questions in the AZ-900 style. Pick your answers, then check them. You will see why each option is right or wrong. Score 75% or more and this topic is marked complete.

Question 1

Question 1 of 3

Partner consultants need access to an internal app using their own work accounts. What should you use?

Question 2

Question 2 of 3

Which option lets consumers sign up and sign in to a public-facing app?

Question 3

Question 3 of 3

How do invited partner users appear in your directory?

Quick revision

Key points

  • External identities let outsiders use their own accounts.
  • B2B collaboration = partner guests.
  • B2B direct connect = trust with another Entra organisation (Teams shared channels).
  • Entra External ID for customers = sign-up/sign-in for consumer apps.

Important terminology

External identity
An identity from outside your organisation used to access your resources.
B2B collaboration
Inviting external users as guests who sign in with their own credentials.
B2B direct connect
A trust with another Entra organisation, used for Teams shared channels.
Microsoft Entra External ID (customers)
Customer identity and access management for public-facing apps.

Common mistakes

  • Creating internal accounts with passwords for every partner.

Exam tips

  • "Partners sign in with their own work accounts" = B2B collaboration (external identities).

Five quick revision questions

  1. 1.What do external users sign in with?Show

    Their own identities, such as their work or social accounts.

  2. 2.What are invited partners called in your directory?Show

    Guest users.

  3. 3.Which option is for consumers of a public app?Show

    Microsoft Entra External ID for customers.

  4. 4.Name one way to control guest access.Show

    Access reviews (also Conditional Access with MFA).

  5. 5.What is B2B direct connect used for?Show

    Trust with another Entra organisation, for example Teams shared channels.

Official references

Make it stick: play a quick gameSort It, Match the Pairs, Lightning Round and Who Am I? Earn XP and badges. Play ❯

Finished this lesson? Tick it off. Your progress is saved in this browser.

Next up: Conditional Access