Entra External ID Tenants¶

Monitor and rotate App Registration credentials in Microsoft Entra External ID tenants. External ID is Microsoft's successor to Azure AD B2C, and CertifyClouds supports both tenant types side by side while you migrate.

Overview¶

CertifyClouds connects to an External ID tenant through a dedicated service principal and can:

• Discover App Registrations in the external tenant
• Inventory secrets and certificates with their expiry dates
• Rotate secrets and certificates
• Propagate rotated credentials to acknowledged Key Vault targets
• Send credential-expiry alerts, including owner-scoped alerts

Understanding External ID vs B2C¶

You can register B2C and External ID tenants at the same time. This keeps credential monitoring and rotation available on both sides of a phased migration.

Prerequisites¶

Before configuring an External ID tenant:

1. PRO or ENTERPRISE tier licence
2. Entra External ID external tenant to monitor
3. Admin access in the external tenant to create an App Registration and client secret
4. Permission to grant tenant-wide admin consent for Microsoft Graph application permissions

Required Information¶

Setup Steps¶

Step 1: Access the External Tenant¶

1. Go to Azure Portal (portal.azure.com)
2. Click your profile icon, then Switch directory
3. Select the Entra External ID external tenant you want CertifyClouds to manage
4. Confirm that the directory ID and primary domain match the values you plan to register

Step 2: Create the CertifyClouds Service Principal¶

Create the App Registration inside the external tenant, not your workforce or home tenant:

1. Navigate to Microsoft Entra ID → App registrations
2. Click + New registration
3. Configure:

1. Click Register
2. Copy the Application (client) ID and Directory (tenant) ID

Step 3: Create a Client Secret¶

1. Open Certificates & secrets on the new App Registration
2. Click + New client secret
3. Enter a description such as CertifyClouds External ID Access
4. Choose an expiry that meets your security policy
5. Click Add
6. Copy the secret Value immediately; Azure will not display it again

Step 4: Grant Required Microsoft Graph Permissions¶

1. Go to API permissions
2. Click + Add a permission
3. Select Microsoft Graph → Application permissions
4. Add permissions:

!!! tip "Least Privilege" For discovery-only, Application.Read.All is sufficient. Add ReadWrite.All only if you want CertifyClouds to rotate External ID credentials. ReadWrite.All is a strict superset, so don't grant both.

1. Click Grant admin consent for [Your External Tenant]
2. Verify that each permission you granted shows admin consent

CertifyClouds Configuration¶

Once the external tenant has a service principal with consented permissions, register it in the app. The steps are the same for Entra External ID and Azure AD B2C, so they are documented once in Registering and managing external tenants: Tenants → External → Add Tenant, set Tenant Type to Entra External ID (CIAM), enter the tenant and credential details, Test Connection, then Register Tenant.

What Gets Discovered¶

For each App Registration credential in the External ID tenant:

Discovery, Rotation, and Propagation¶

External ID tenants use the same CertifyClouds workflows as B2C tenants:

1. Discovery inventories App Registration secrets and certificates
2. You acknowledge the credential's matched Key Vault targets. The per-record Auto toggle only governs automated rotation; Rotate now also works with it off when the credential is otherwise ready.
3. CertifyClouds creates a new secret or certificate in the external tenant
4. The new credential is written to every acknowledged Key Vault target
5. The rotation result and Key Vault propagation status appear in rotation history
6. Expiry rules continue to evaluate the discovered credentials and notify configured recipients

Both secret rotation and certificate rotation are supported. Key Vault targets remain in the corporate tenant and are updated through the existing propagation workflow.

Differences from Azure AD B2C¶

These differences do not change the standard CertifyClouds discovery, rotation, Key Vault propagation, or alert workflows described above.

Configuring Alerts¶

Expiry alerts for External ID credentials are set up the same way as for any external tenant, including owner-scoped delivery. See Configuring alerts.

Troubleshooting¶

Common Issues¶

Security Best Practices¶

See Security best practices on the shared page. They apply unchanged to External ID tenants.