Entra External ID represents Microsoft’s next generation Consumer and Identity Management (CIAM) solution that provides external entities with secure access to applications and resources. It supersedes Azure AD B2C by providing a unified platform for CIAM and B2B collaboration. This two-day course covers the fundamentals of Entra External ID that developers and administrators need to know to get started using the latest Microsoft CIAM technology.
Attendees will learn the best practices and patterns for architecting identity management solutions with Entra External ID.
Entra External ID Introduction
This module covers the fundamentals of how to get started with Entra External ID. It discusses the important aspects of an external tenant, covering how it differs from a workforce tenant, how it is billed to an Azure subscription, how it is created, and how to use the Quickstart guide to create and test a sign up/sign in user flow.
User flows
This section provides coverage of the details of the artifacts created by the Quickstart guide introduced in the previous module. It discusses how the App Registration settings are configured, and how user flows can be viewed, associated with an application, and ultimately run. It concludes by showing how to add user attributes to the sign-up flow and Json Web Token (JWT), and how to enable self-service password reset (SSPR).
Identity Providers and Multi-Factor Authentication (MFA)
Entra External ID provides a number of different options for authenticating users. This module covers the full range of currently available local account, social account and custom identity provider alternatives provided by Entra External ID. It also covers the details of how to configure conditional access settings to enable MFA as part of the sign-in process.
Custom Authentication Extensions
Entra External ID user flows can be extended with custom business logic by providing a REST endpoint that is invoked when one of the built-in authentication events fires. This module discusses the four currently available events that fire: (1) at the beginning of attribute collection, (2) when the attributes have been entered and submitted, (3) when a one-time passcode is sent, and (4) right before the token is issued to the application. It concludes by demonstrating how to create REST endpoints that respond to these events.
Graph API
The Graph API allows developers to programmatically manage Entra External ID resources and represents an essential tool for building a real-world Entra External ID application. Since many Entra External ID user attributes cannot be viewed and modified in the Azure portal, one of the most common use cases for the Graph API is to manage extension attributes defined in custom policies. This module demonstrates how to register and write a .NET application that uses the Graph API to perform CRUD operations on the resources in the Entra External ID directory.
Native authentication
User flows delegate to the browser and redirect back to the application when the user has been authenticated. It represents the simplest and most secure option but offers limited support for UI customization. In contrast, with native authentication, the app maintains full control allowing for much greater flexibility and a much richer sign-up and sign-in user experience. This module discusses when to use native authentication, the risks of using it, how to enable it, and how to use the native authentication SDKs and APIs to customize the user sign-up and sign-in experience.
Atmosera can provide this course virtually or on-site. Please reach out to discuss your requirements.