Single Sign-On and External Identities

Single Sign-On (SSO) allows a user to authenticate once and gain access to multiple applications without re-entering credentials for each one. Entra ID acts as the central identity provider (IdP): after signing in to the Microsoft identity platform, tokens are issued that grant access to any registered application the user is entitled to use. SSO improves security by reducing password fatigue and the proliferation of per-app credentials.

Entra ID supports two primary SSO protocols. OpenID Connect (OIDC) is the modern standard built on OAuth 2.0, used by Microsoft's own apps and most new SaaS applications — it issues JSON Web Tokens (JWTs). SAML 2.0 is an older XML-based protocol still required by many legacy enterprise applications and is supported by thousands of pre-integrated apps in the Entra ID application gallery.

Entra ID provides an application gallery with pre-built SSO integrations for over 3,000 SaaS applications including Salesforce, ServiceNow, GitHub Enterprise, AWS, Zoom, and many more. Adding an application from the gallery auto-configures the SSO metadata, dramatically reducing integration time. For apps not in the gallery, you can manually configure SAML or OIDC federation parameters.

The My Apps portal (myapps.microsoft.com) is a self-service web portal where users see all enterprise applications they have been assigned access to, and can launch them with a single click. IT administrators control which apps appear and for which users. Users can also manage group memberships and access requests from this portal if self-service capabilities are enabled.

Entra ID B2B (Business-to-Business) allows you to invite external partners, contractors, and vendors to your tenant as guest users. Guests authenticate with their own organisation's identity provider (another Entra ID tenant, Google, or any SAML/OIDC provider), then receive an access token to your resources. You control exactly which apps, groups, and resources guests can access through standard RBAC and Conditional Access policies.

When you invite an external user, they receive an email invitation with a redemption link. Upon clicking the link, they authenticate using their own credentials (not a new password in your tenant), and Entra ID creates a guest user object in your directory representing them. From that point, administrators assign roles and group memberships to the guest user just like internal users, but the guest continues to authenticate through their home organisation.

Entra External ID for customers (formerly Azure AD B2C) is a separate identity service for consumer-facing applications. It allows customers to sign up and sign in using their email address, phone number, or social accounts (Google, Facebook, Apple). Unlike B2B, which federates with existing organisational identities, B2C creates and manages customer identity accounts, supporting millions of users with custom branded sign-in experiences.

Choosing between B2B and B2C depends on who the users are. B2B is for business partners and employees of other organisations who already have a corporate identity they authenticate with. B2C is for end consumers who do not have an organisational identity — they register with an email or social account. B2B users appear in your tenant as guests; B2C users are stored in the B2C tenant's own directory.

Entra ID supports direct federation with external SAML or WS-Fed identity providers. This is useful when a partner organisation uses a non-Microsoft IdP such as Okta, Ping Identity, or AD FS. After setting up federation, all users from the partner's domain can sign in to your applications using their own IdP, without needing individual guest invitations — ideal for large partnerships with many users.

Cross-tenant access settings (XTAP) in Entra ID give you fine-grained control over inbound and outbound collaboration with specific partner tenants. You can configure per-tenant policies to trust (or not trust) the partner's MFA claims and device compliance status, eliminating the need for guests to re-do MFA when they have already satisfied it in their home tenant. XTAP replaces the older B2B allow/deny lists.

Entra ID supports eliminating passwords entirely through passwordless authentication. Options include: Windows Hello for Business (biometric or PIN tied to a device), FIDO2 security keys (hardware USB/NFC keys from YubiKey, etc.), and Microsoft Authenticator app using phone sign-in (number matching). Passwordless methods are both more secure than passwords and more convenient for users, addressing the primary attack vector for account takeovers.

Test your understanding of Microsoft Azure Fundamentals (AZ-900) concepts from this lesson.

In this lesson you learned: SSO using Entra ID allows users to authenticate once and access multiple applications, B2B invites external partners as guest users who authenticate with their own IdP, and B2C manages consumer identity accounts with social login support. Next up we explore Azure's security tools starting with Microsoft Defender for Cloud.