External tenants (Azure AD B2C)¶
PRO + ENTERPRISE Feature
The External Tenant Registry requires a PRO or ENTERPRISE tier licence.
Monitor credential expiry in your Azure AD B2C tenants to prevent authentication failures in customer-facing applications.
Planning a migration from Azure AD B2C? Microsoft Entra External ID is its successor, and CertifyClouds supports both tenant types side by side during migration. See Entra External ID Tenants for the External ID onboarding guide.
Overview¶
The External Tenant Registry lets CertifyClouds scan your Azure AD B2C tenants and discover:
- All App Registrations in the B2C tenant
- Secrets and certificates with expiry dates
- Credentials that are expired or expiring soon
B2C vs SSO
This feature is separate from SSO Setup. SSO is for authenticating users to CertifyClouds. The External Tenant Registry is for scanning your B2C tenants.
Understanding B2C vs Regular Entra ID¶
| Aspect | Microsoft Entra ID | Azure AD B2C |
|---|---|---|
| Purpose | Employee/internal identity | Customer/consumer identity |
| Users | Your organisation's employees | External customers |
| Common Use | Microsoft 365, internal apps | Consumer-facing apps, e-commerce |
| Key Vaults | Yes | No - B2C tenants are identity-only |
| App Registrations | Yes | Yes - for customer-facing apps |
CertifyClouds scans the App Registrations in your B2C tenant to monitor credential expiry for your customer-facing applications.
Prerequisites¶
Before registering a B2C tenant:
- PRO tier licence
- Azure AD B2C tenant to monitor
- Admin access to create service principal
- Microsoft Graph permissions - Ability to grant admin consent
Required Information¶
| Item | Description | Example |
|---|---|---|
| B2C Tenant ID | GUID of your B2C tenant | 12345678-abcd-1234-... |
| B2C Tenant Domain | Primary domain | yourcompany.onmicrosoft.com |
| Service Principal Client ID | App registration for scanning | abcd1234-... |
| Service Principal Secret | Client secret | secret_... |
Setup Steps¶
Step 1: Access Your B2C Tenant¶
- Go to Azure Portal (portal.azure.com)
- Click your profile icon → Switch directory
- Select your Azure AD B2C tenant
- Verify you see "Azure AD B2C" in the top-left
Step 2: Create Service Principal¶
- Navigate to Azure AD B2C → App registrations
- Click + New registration
- Configure:
| Field | Value |
|---|---|
| Name | CertifyClouds B2C Scanner Workload - <Tenant Name> (Production) |
| Supported account types | Accounts in this organizational directory only |
| Redirect URI | Leave blank |
- Click Register
- Copy the Application (client) ID
Step 3: Create Client Secret¶
- Go to Certificates & secrets
- Click + New client secret
- Configure:
| Field | Value |
|---|---|
| Description | CertifyClouds B2C Access |
| Expires | 24 months |
- Click Add
- Copy the secret Value immediately
Step 4: Grant API Permissions¶
- Go to API permissions
- Click + Add a permission
- Select Microsoft Graph → Application permissions
- Add permissions:
| Permission | Purpose |
|---|---|
Application.Read.All | Read app registrations (discovery only) |
Organization.Read.All | Read tenant info |
User.ReadBasic.All | Resolve App Registration owners for owner-scoped expiry alerts |
Application.ReadWrite.All | Modify registrations (for rotation) |
!!! tip "Least Privilege" For discovery-only, Application.Read.All is sufficient. Add ReadWrite.All only if you want CertifyClouds to rotate B2C credentials. ReadWrite.All is a strict superset, so don't grant both.
!!! warning "Owner alerts need permission to read user details" Without User.ReadBasic.All or a broader permission that covers it, Microsoft Graph returns owner references with no usable identity details. Discovery still completes, but the owner list comes back empty and owner-scoped expiry alerts deliver to nobody.
- Click Grant admin consent for [Your B2C Tenant]
- Verify green checkmarks appear
CertifyClouds Configuration¶
Once the B2C tenant has a service principal with consented permissions, register it in the app. The steps are the same for B2C and Entra External ID, so they are documented once in Registering and managing external tenants: Tenants → External → Add Tenant, set Tenant Type to Azure AD B2C, enter the tenant and credential details, Test Connection, then Register Tenant.
What Gets Discovered¶
For each App Registration in your B2C tenant:
| Item | Details |
|---|---|
| App Name | Display name |
| Client ID | Application ID |
| Secrets | Password credentials with expiry |
| Certificates | Key credentials with expiry |
| Expiry Status | Expired, Expiring Soon (≤30 days), Valid |
Rotating B2C Credentials¶
With Application.ReadWrite.All granted to the scanner service principal, CertifyClouds can rotate a B2C app's client secret or certificate directly from the UI, with the same confirm-and-progress flow as corporate App Registration rotation.
How It Works¶
- Acknowledge the app's matched Key Vault targets (the corporate-tenant Key Vault entries that store the credential). The per-record Auto toggle only governs automated rotation; Rotate now also works with it off when the credential is otherwise ready.
- Start the rotation - a confirmation dialog summarises what will change, then a progress modal streams each step in real time
- A new credential is created on the B2C app
- The new value is written to every acknowledged Key Vault target
- The old credential stays valid for the configured grace window, then is removed automatically - cleanup runs against the B2C tenant using that tenant's own service principal
- The run appears in Automation → Rotation → History alongside corporate rotations, with a tenant badge
Azure B2C's two-credential cap
Azure limits B2C apps to 2 credentials per app. CertifyClouds only ever replaces the credential being rotated - other credentials on the app are never touched. If the app is already at the cap, the old credential is removed during the rotation itself (there is no free slot), so no grace window applies.
Scanner Secret Self-Rotation¶
The per-tenant scanner service principal can rotate its own client secret:
- Auto-rotate before expiry - opt-in per tenant
- Rotate now - rotate immediately from the tenant card
Each rotation mints a new secret, verifies it with a real Microsoft Graph token acquisition, persists it, and only then retires the old one. See Rotating CertifyClouds' Own Credentials.
Configuring Alerts¶
Expiry alerts for B2C credentials are set up the same way as for any external tenant. See Configuring alerts.
Troubleshooting¶
Common Issues¶
| Issue | Cause | Solution |
|---|---|---|
| "Connection failed" | Invalid credentials | Verify Client ID and Secret |
| "Access denied" | Missing permissions | Ensure permissions are granted |
| "Admin consent required" | Consent not granted | Grant admin consent in Azure |
| "Tenant not found" | Wrong tenant ID | Use B2C tenant ID (not regular AD) |
| "No apps discovered" | Empty tenant | Verify B2C has app registrations |
Verify Permissions¶
# Test Graph API access
az login --tenant YOUR_B2C_TENANT_ID
az ad app list --query "[].{name:displayName, appId:appId}" -o table
Security Best Practices¶
The general rules are on the shared page: Security best practices.
One thing is specific to B2C: the scanner service principal can renew its own secret, so you do not have to diary it. See Scanner Secret Self-Rotation.