Entra External ID Tenants¶

Monitor and rotate App Registration credentials in Microsoft Entra External ID tenants. External ID is Microsoft's successor to Azure AD B2C, and CertifyClouds supports both tenant types side by side while you migrate.

Overview¶

CertifyClouds connects to an External ID tenant through a dedicated service principal and can:

• Discover App Registrations in the external tenant
• Inventory secrets and certificates with their expiry dates
• Rotate secrets and certificates
• Propagate rotated credentials to acknowledged Key Vault targets
• Send credential-expiry alerts, including owner-scoped alerts

Understanding External ID vs B2C¶

You can register B2C and External ID tenants at the same time. This keeps credential monitoring and rotation available on both sides of a phased migration.

Prerequisites¶

Before configuring an External ID tenant:

1. PRO or ENTERPRISE tier license
2. Entra External ID external tenant to monitor
3. Admin access in the external tenant to create an App Registration and client secret
4. Permission to grant tenant-wide admin consent for Microsoft Graph application permissions

Required Information¶

Setup Steps¶

Step 1: Access the External Tenant¶

1. Go to Azure Portal (portal.azure.com)
2. Click your profile icon, then Switch directory
3. Select the Entra External ID external tenant you want CertifyClouds to manage
4. Confirm that the directory ID and primary domain match the values you plan to register

Step 2: Create the CertifyClouds Service Principal¶

Create the App Registration inside the external tenant, not your workforce or home tenant:

1. Navigate to Microsoft Entra ID → App registrations
2. Click + New registration
3. Configure:

1. Click Register
2. Copy the Application (client) ID and Directory (tenant) ID

Step 3: Create a Client Secret¶

1. Open Certificates & secrets on the new App Registration
2. Click + New client secret
3. Enter a description such as CertifyClouds External ID Access
4. Choose an expiry that meets your security policy
5. Click Add
6. Copy the secret Value immediately; Azure will not display it again

Step 4: Grant Required Microsoft Graph Permissions¶

1. Go to API permissions
2. Click + Add a permission
3. Select Microsoft Graph → Application permissions
4. Add all three required permissions:

1. Click Grant admin consent for [Your External Tenant]
2. Verify that all three permissions show granted admin consent

CertifyClouds Configuration¶

Step 1: Add the Tenant¶

1. Go to Settings and open the external tenant registry
2. Click Add Tenant
3. Set Tenant kind to External ID

Step 2: Enter Details¶

Step 3: Configure Discovery¶

Step 4: Test and Register¶

1. Click Test Connection
2. Expected: Connection successful - Found organization: [Tenant Name]
3. Click Register Tenant

Step 5: Run Discovery¶

1. Click Discover on the tenant
2. Open the tenant to view its discovered App Registration credentials

What Gets Discovered¶

For each App Registration credential in the External ID tenant:

Discovery, Rotation, and Propagation¶

External ID tenants use the same CertifyClouds workflows as B2C tenants:

1. Discovery inventories App Registration secrets and certificates
2. You enable rotation for a credential and acknowledge its matched Key Vault targets
3. CertifyClouds creates a new secret or certificate in the external tenant
4. The new credential is written to every acknowledged Key Vault target
5. The rotation result and Key Vault propagation status appear in rotation history
6. Expiry rules continue to evaluate the discovered credentials and notify configured recipients

Both secret rotation and certificate rotation are supported. Key Vault targets remain in the corporate tenant and are updated through the existing propagation workflow.

Differences from Azure AD B2C¶

These differences do not change the standard CertifyClouds discovery, rotation, Key Vault propagation, or alert workflows described above.

Configuring Alerts¶

To notify teams about External ID credential expiry:

1. Go to Settings → Alerts
2. Create an Expiry rule for external-tenant credentials
3. Set the warning threshold
4. Configure email or webhook delivery
5. For owner-scoped delivery, select application owners and confirm that the tenant service principal has User.Read.All with admin consent

See Alerts for the full rule model.

Troubleshooting¶

Common Issues¶

Security Best Practices¶

1. Use a dedicated service principal in each External ID tenant
2. Grant only the documented application permissions and review admin consent regularly
3. Rotate the service principal secret before it expires
4. Monitor sign-in and audit logs in the external tenant
5. Separate environments with distinct service principals where practical