Migrating Azure AD B2C Custom Policy REST API Call on Signup to Microsoft Entra (External ID) – Recommended Architecture?

Thanks for the reply. To clarify and get a complete step-by-step guidance, here is my exact use case and what I need.

Use Case: When a new user signs up in Microsoft Entra External ID, I must call a backend REST API after the user is created.

The REST API call must:

• Use OAuth Bearer token for authentication (client credentials or managed identity)

Include in the payload user attributes such as:

objectId

  `username` / `email`
  
     `contact` / `mobilePhone`
     
        Any other custom claims
        
        Execute **only after the user has been created** (not before or during signup)
        

I understand that Azure AD B2C custom policies supported this via REST technical profiles called in orchestration steps. That exact pattern does not exist in Microsoft Entra External ID because custom policies are removed.

What I need now: A step-by-step implementation procedure to achieve this same functional behavior in Microsoft Entra, including:

How to detect user signup completion in Entra

How to reliably trigger a backend integration only after the user is fully created

How to securely get an OAuth Bearer token

Whether via client credentials or managed identity

Best practice recommended approach

How to call the backend REST API with user claims in the payload

How to handle errors / retries reliably

End-to-end testing steps (how to verify workflow)

In your answer, please include:

Azure Portal steps for each part

Python SDK or Azure Functions code samples (Python)

Official Microsoft documentation links for each feature used

E.g., user lifecycle events, Event Grid, Azure Functions, managed identity, etc.

I’m not looking for a conceptual overview — I need a full step-by-step procedure someone can follow from scratch to test the complete flow.

Here are the two REST technical profiles I had in B2C for reference (this is the behavior I want to replicate):Thanks for the reply. To clarify and get a complete step-by-step guidance, here is my exact use case and what I need.

Use Case:
When a new user signs up in Microsoft Entra External ID, I must call a backend REST API after the user is created.

The REST API call must:

Use OAuth Bearer token for authentication (client credentials or managed identity)

Include in the payload user attributes such as:

objectId

  `username` / `email`
  
     `contact` / `mobilePhone`
     
        Any other custom claims
        
        Execute **only after the user has been created** (not before or during signup)
        

I understand that Azure AD B2C custom policies supported this via REST technical profiles called in orchestration steps.
That exact pattern does not exist in Microsoft Entra External ID because custom policies are removed.

What I need now:
A step-by-step implementation procedure to achieve this same functional behavior in Microsoft Entra, including:

How to detect user signup completion in Entra

How to reliably trigger a backend integration only after the user is fully created

How to securely get an OAuth Bearer token

Whether via client credentials or managed identity

Best practice recommended approach

How to call the backend REST API with user claims in the payload

How to handle errors / retries reliably

End-to-end testing steps (how to verify workflow)

In your answer, please include:

Azure Portal steps for each part

Python SDK or Azure Functions code samples (Python)

Official Microsoft documentation links for each feature used

E.g., user lifecycle events, Event Grid, Azure Functions, managed identity, etc.

I’m not looking for a conceptual overview — I need a full step-by-step procedure someone can follow from scratch to test the complete flow.

Here are the two REST technical profiles I had in B2C for reference (this is the behavior I want to replicate):

<TechnicalProfile Id="REST-GetAccessToken">
 <DisplayName>Request Access Token using Client Credentials</DisplayName>
 <Protocol Name="Proprietary"
           Handler="Web.TPEngine.Providers.RestfulProvider, Web.TPEngine" />
 <Metadata>
   <Item Key="ServiceUrl">https://{tenant}.b2clogin.com/{tenant}.onmicrosoft.com/B2C_1A_SIGNUP_SIGNIN/oauth2/v2.0/token</Item>
   <Item Key="AuthenticationType">None</Item>
   <Item Key="SendClaimsIn">Form</Item>
 </Metadata>
 <InputClaims>
   <InputClaim ClaimTypeReferenceId="client_id" />
   <InputClaim ClaimTypeReferenceId="client_secret" />
   <InputClaim ClaimTypeReferenceId="grant_type" DefaultValue="client_credentials" />
   <InputClaim ClaimTypeReferenceId="scope"
               DefaultValue="https://{tenant}.onmicrosoft.com/{api-client-id}/.default" />
 </InputClaims>
 <OutputClaims>
   <OutputClaim ClaimTypeReferenceId="accessToken" PartnerClaimType="access_token" />
 </OutputClaims>
</TechnicalProfile>

<TechnicalProfile Id="REST-API-SignUp">
 <DisplayName>Notify backend about user registration</DisplayName>
 <Protocol Name="Proprietary"
           Handler="Web.TPEngine.Providers.RestfulProvider, Web.TPEngine" />
 <Metadata>
   <Item Key="ServiceUrl">https://backend-api.example.com/api/user/signup</Item>
   <Item Key="AuthenticationType">Bearer</Item>
   <Item Key="UseClaimAsBearerToken">accessToken</Item>
   <Item Key="SendClaimsIn">Body</Item>
 </Metadata>
 <InputClaims>
   <InputClaim ClaimTypeReferenceId="objectId" />
   <InputClaim ClaimTypeReferenceId="email" />
   <InputClaim ClaimTypeReferenceId="displayName" />
   <InputClaim ClaimTypeReferenceId="mobilePhone" />
   <InputClaim ClaimTypeReferenceId="referralCode" />
 </InputClaims>
</TechnicalProfile>

I want an equivalent step-by-step Entra External ID + Azure services solution that does the same thing after user signup completes. Thanks!