MAITS — Securing what mattersTalk to MAITS

Azure AD B2C migration

Move to Entra External ID
without gambling the customer journey.

Azure AD B2C is no longer available to purchase for new customers. Existing estates need a deliberate transition that protects sign-in, identity data and application continuity.

Plan your B2C migration See the migration path
A platform move and an identity migration

Custom policies, user stores, credentials, federation, application dependencies and customer communications all affect the cutover.

Migration architecture

One destination. Several interdependent transitions.

The migration plan must keep identity data, authentication and relying applications aligned at every stage.

CURRENT STATEAzure AD B2CUsers · credentials · policies · applications
01Assess
02Design
03Pilot
04Migrate
05Cut over
06Retire
TARGET STATEMicrosoft Entra External IDExternal tenant · user flows · extensions · applications
A controlled transition across identity data, credentials, policy, application integration and customer experience.

What makes it difficult

The visible login page is only the surface.

IDENTITIES

User and attribute mapping

Clean and map accounts, custom attributes, identifiers, consent and reconciliation rules into the target external tenant.

CREDENTIALS

Password and sign-in continuity

Choose a credential strategy such as just-in-time or staged migration, then design fallback and recovery paths.

POLICY

Custom journeys and extensions

Translate existing user flows and custom policy behaviour into supported External ID patterns and custom authentication extensions.

APPLICATIONS

Protocol and integration change

Reconfigure applications, redirect URIs, claims, tokens, APIs, secrets and environments without uncontrolled downtime.

Customer identity architecture

Preserve the full customer journey, not only the account.

ESTABLISH

Registration & profile

Sign-up, progressive attributes, consent, identity verification and privacy-aware customer data.

AUTHENTICATE

Sign-in & recovery

Password, MFA, passkey readiness, social identity, enterprise federation and safe account recovery.

AUTHORISE

Applications & APIs

Tokens, claims, scopes, application roles, consent and downstream customer access decisions.

EXTEND TRUST

Credentials & relationships

Keep account identity distinct from verified evidence, delegated relationships and DiligenceID use cases.

MAITS migration method

A sequence designed for evidence, rehearsal and rollback.

01

Discover

Inventory tenants, policies, identity data, providers, applications, APIs and support processes.

02

Map

Compare B2C capability with External ID and expose unsupported or redesigned patterns.

03

Design

Define target journeys, data and credential migration, coexistence, telemetry and cutover.

04

Build

Configure the external tenant, extensions, branding, applications and migration services.

05

Pilot

Validate representative users, edge cases, recovery, support and operational evidence.

06

Migrate

Move cohorts with reconciliation, communication and controlled fallbacks.

07

Cut over

Shift applications and journeys using rehearsed decision points and rollback criteria.

08

Retire

Confirm dependencies, retention and support before decommissioning legacy components.

Decisions to make early

Avoid discovering the migration strategy during cutover.

Establish how users are matched, when credentials move, whether systems coexist, how application sessions behave and what happens when identity reconciliation fails.

MAITS brings identity architecture and delivery assurance together so customer experience, security and operational readiness are treated as one problem.

Microsoft migration guidance

Migration inventory

Expose every dependency before choosing a cutover pattern.

  • Users, identifiers and credentials
  • Custom and extension attributes
  • User flows and custom policies
  • Social and enterprise identity providers
  • Applications, APIs and environments
  • Token, claim and session behaviour
  • Branding, consent and communications
  • MFA, registration and recovery
  • Bulk, staged or just-in-time migration options
  • Coexistence and routing
  • Rollback and reconciliation
  • Legacy retirement

Service 13 · Controlled retirement

Azure AD B2C Decommissioning & Tenant Teardown.

Decommissioning legacy B2C requires more than deleting resources. It demands systematic verification that all dependencies, user accounts, audit logs, and DNS records have safely transitioned.

Plan B2C decommissioning

MAITS executes a structured, audited B2C decommissioning framework to prevent orphaned credentials, ghost redirect URIs, and compliance gaps.

DATA RETENTION

Audit & archive verification

Extract and securely archive historical sign-in logs, audit events, and user records in compliance with New Zealand and Australian statutory data retention rules.

CUSTOM POLICIES

Policy & key archival

Safely export custom XML trust framework policies, cryptographic signing keys, and certificate assets into version-controlled escrow before tenant termination.

DNS & ROUTING

Vanity domain retirement

Reconfigure custom domains, reverse proxies, and Front Door origin paths without stranding active user sessions or bookmark links.

TEARDOWN GATE

Formal sign-off & teardown

Execute final dependency severing, client application deregistrations, Azure subscription detachment, and issue a formal completion certificate.

Start a conversation

Turn the B2C deadline into a controlled programme.

Start with an estate assessment and a migration architecture grounded in your actual policies, users and applications.

Discuss your B2C migration Explore External ID consulting