Share via

Managing Identity with Azure Entra for Multiple Clients

Deepak Arora 20 Reputation points
2025-04-29T08:08:53.3866667+00:00

How can Azure Entra be utilized to manage identity for a web application that is expecting to grow from approximately 200 clients? Each client can customize their login theme and will have multiple users.

Considering that Azure Entra ID has a limitation of 200 tenants and Azure Entra External ID supports up to 20 tenants per subscription, what would be the best solution to accommodate these requirements?

Microsoft Entra External ID
Microsoft Entra External ID
A modern identity solution for securing access to customer, citizen and partner-facing apps and services. It is the converged platform of Azure AD External Identities B2B and B2C. Replaces Azure Active Directory External Identities.
3,156 questions
Accepted answer
  1. Sakshi Devkante 3,335 Reputation points Microsoft External Staff
    2025-04-29T17:08:31.83+00:00

    Hello Deepak Arora

    While Azure Entra External ID (for customers) has some subscription-level tenant limits, the better long-term solution is to use a single Azure Entra External ID (B2C) tenant and implement per-client branding and segregation within that.

    Rather than creating a tenant per client (which hits the 200-tenant limit), leverage a single Azure Entra ID tenant and manage clients within that tenant using custom policies, branding, and group/user management.

    Azure Entra External ID (formerly Azure AD B2C) allows you to manage identities of external users (e.g., customers) within a single tenant, and it's designed for multi-organization support without requiring one tenant per customer.

    Azure Entra External ID supports customized user flows and custom policies (Identity Experience Framework), including:

    Custom UI per client: You can dynamically load branding (logos, colors) based on the domain or query string.

    Separate user journeys: Custom policies allow defining different flows per client (e.g., signup, login, MFA).

    Domain filtering: Based on email domain or another identifier, route users through the correct flow.

    You do not need to create one Entra tenant per client. Instead, simulate multi-tenancy by:

    -Storing client metadata in a database (branding settings, allowed domains, etc.).

    -Using pre-authentication logic (e.g., in the web app or via B2C prebuilt/custom policies) to select branding and flow.

    Working with Azure AD B2C Custom Policies
    Azure AD B2C custom policy overview
    Considerations for using Azure Active Directory B2C in a multitenant architecture
    Enable custom domains in Azure Active Directory B2C
    how-to-custom-oidc-federation-customers

    Within a single B2C tenant, you can:

    -Tag users with custom attributes (e.g., clientId) to group them by organization.

    -Use Access Control in your app to enforce client boundaries (i.e., a user in Client A can’t access Client B’s data)

    Use Conditional Access, MFA, identity protection, and verified domains per client to enforce secure access as needed.

    If you feel this clarified your question Please remember to "Accept Answer", so that others in the community facing similar issues can easily find this post.

    1 person found this answer helpful.

0 additional answers

Sort by: Most helpful
Most helpful Newest Oldest

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.