Alright, I've been down this rabbit hole for the past three weeks and my team is tired of hearing about it. We're building a patient portal (HIPAA, obviously) and need a rock-solid B2C identity provider. The final contenders are **Microsoft Entra ID External Identities** (formerly Azure AD B2C) and **Auth0**.
I've set up PoCs for both, and the devil is in the details. Here's my running comparison:
**Entra ID Pros:**
* Native integration with our other Azure services is stupidly easy. Managed identities, key vault, the whole suite just talks to each other.
* The custom policies (Identity Experience Framework) are incredibly powerful for complex user journeys, like step-up authentication for accessing sensitive health records.
* Cost predictability is better for us at scale, given our existing Azure commitment.
**Auth0 Pros:**
* The developer experience feels smoother. Their documentation and quickstart guides got a working prototype up faster.
* The Actions ecosystem is more flexible for lightweight workflows without diving into XML policies (Entra's custom policies are powerful but feel like coding in XML from 2003).
* Out-of-the-box anomaly detection and breached password screening seemed more tuned for consumer-scale attacks right out of the gate.
My big sticking points:
1. **HIPAA BAA:** Both offer it, but Microsoft's feels more "baked-in" due to our overall Azure BAA. With Auth0, it's a separate piece.
2. **Social/External IdP Connections:** Auth0 makes adding Google, Apple, Facebook login a 5-minute task. Entra requires a bit more configuration in the tenant.
3. **Support:** Has anyone had to use enterprise support for a critical auth flow issue? Which vendor got you a solution faster?
Specifically for healthcare apps, how do you weigh the **deep Azure integration** of Entra against the **developer agility** of Auth0? Is anyone running a hybrid or multi-tenant setup to get the best of both?
Still looking for the perfect one