Security Limitations Re: Azure B2C

Question

I wanted to know the key differences in security between Entra External IDs and Azure B2C.

I know several of them so far such as Defender for Cloud is not supported by AB2C and several of the sign in risks (and all user risk) detections are not available as well as stated here:

https://learn.microsoft.com/en-us/azure/active-directory-b2c/conditional-access-identity-protection-overview

The one question I need a firm answer on is whether a AB2C user sign in logs can be attributed to a user. The following article leaves me with confusion:

https://learn.microsoft.com/en-us/azure/active-directory-b2c/view-audit-logs

My question is this, (1) by what way(s) can you attribute a sign in in AB2C and Entra External IDs to a user account, and (2) what are the differences in all log events for them both as well.

-Thank you in advance!

Answer 1

Hi @Ron Windle

Thanks for posting your question in the Microsoft Q&A forum.

For your query, I understand that you would like to know differences between Azure B2C and Entra External IDs, focusing on their security features and logging capabilities.

Azure AD B2C provides identity protection features, such as risk-based conditional access policies and the ability to detect and respond to risky sign-ins. This includes the ability to block or allow access based on the risk level of the sign-in.

Microsoft Entra External IDs have its own set of security features for identity protection, risk detectiona and adaptive access policies. but the specific information would depend on the implementation and configuration of the solution.

To answer your first questions, In Azure B2C attribute a sign-in to a user account by using user attributes. During the sign-up or sign-in process, you can collect user attributes such as city, job title, or a custom attribute like a loyalty ID. These attributes are stored with the user’s profile in the directory.

For Entra External IDs you can also attribute a sign-in to a user account by using user attributes. You can choose from built-in user attributes or create custom user attributes, you can add these attributes at the tenant level so they can be used in any user flow in the tenant.

Regarding your second question, the log events in Azure AD B2C and Entra External IDs are different because they are designed for different use cases. Azure AD B2C provides audit logs for user sign-ins, user management, and application management. Entra External IDs provides audit logs for identity governance, including access reviews, role assignments, and policy changes.

Both Azure AD B2C and Entra External IDs provide audit logs for user sign-ins and user management, but Entra External IDs is designed for identity governance and provides additional audit logs for access reviews, role assignments, and policy changes.

Reference: https://learn.microsoft.com/en-us/entra/external-id/customers/faq-customers

https://learn.microsoft.com/en-us/entra/external-id/external-identities-overview

https://learn.microsoft.com/en-us/azure/active-directory-b2c/user-profile-attributes

Thanks,

Akhilesh.

Hope this helps. Do let us know if you any further queries.

---

If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.