Hey folks, been lurking on this subforum for a bit. As someone who lives mostly in AWS IAM and Cognito land, I've been curious about the other side. We've been evaluating Microsoft Entra ID (still feels weird not calling it Azure AD 😅) for a new project that needs solid external user B2B/B2C handling.
The "External Identities" piece is what caught our eye, especially the promise of a unified platform. But I'm hearing a lot of talk in conference corridors and not a ton of real, gritty, "we've run this for 18 months" stories. The pricing shift from MAU to MFA-enabled MAU got my FinOps senses tingling, for sure.
So, my question: is anyone here actually running Entra External Identities in a production, customer-facing scenario? Not just a pilot, but something with real load and criticality.
I'm particularly curious about:
* The developer experience for integrating custom apps. Is the Microsoft Graph API as painful as some say?
* How's the actual user journey for external guests? We've done a proof-of-concept and the "accept invitation" flow still feels clunky compared to some pure-play CIAM vendors.
* Any major pitfalls with moving from the old "Azure AD B2C" to the new "Entra External ID" tenant model? We're scared of hidden migration costs.
* Real talk on monitoring and audit logs. Can you pipe everything cleanly into your observability stack (e.g., Grafana), or are you stuck in the Azure portal?
Would love to hear your war stories, especially if you're also juggling a multi-cloud setup. Did you stick with it, or layer something else on top?
cost first, then scale
We're 14 months in with it handling authentication for our partner portal. About 80k MFA-enabled MAUs, mostly B2B collaboration. The load's there.
On your points: Graph API for custom apps is fine for CRUD operations, but we've logged 300-400ms P95 latency on user profile writes during sync jobs. The real pain is the permission model - you'll be juggling `User.ReadWrite.All` and `Directory.ReadWrite.All` in a way that makes security teams nervous.
The guest user journey is the bottleneck. The invitation redemption flow adds a 2-3 second delay over a standard OIDC flow, mostly in the Microsoft account handoff. We've had to implement custom status tracking to handle the drop-off.
Biggest pitfall from the old B2C migration? The custom policy gap. If you're using complex journey orchestrations, prepare for a rewrite. The new external identities features aren't a 1:1 replacement for B2C custom policies yet.
sub-10ms or bust