Table of Contents
1. Introduction and Objectives
Objective
This document describes the administrative tasks in managing Entra External ID (formerly Azure AD B2C)[1] for integration with Microsoft Power Pages. It clearly distinguishes between one-time setup tasks and ongoing maintenance work.
Target Audience
IT administrators and identity professionals with basic knowledge of Azure/Entra ID. Technical understanding of OAuth2/OpenID Connect[2] is beneficial but not mandatory.
Initial Setup
Monitoring
Prerequisites
| Category | Requirement | Required |
|---|---|---|
| Azure Access | Azure subscription with active subscription | Yes |
| Permissions | Global Administrator or Identity Administrator[4] | Yes |
| Licensing | Entra External ID License (MAU-based)[5] | Yes |
| Power Pages | Power Pages Environment with Admin access[6] | Yes |
| Domain | Custom domain for Custom Branding (optional) | No |
2. Overview: One-Time vs. Regular Tasks
One-Time Setup Tasks
These tasks are performed once during initial setup:
Important
After successful setup, the administrative effort is minimal. Most activities are limited to monitoring and occasional updates. Portal users manage their accounts independently (password reset, profile updates).
3. One-Time Setup Tasks
Create a dedicated External ID Tenant for portal authentication.[7]
- In Azure Portal navigate to: Microsoft Entra ID > External Identities
- Click on "Create a new tenant"
- Select Tenant type: "External"
- Assign Tenant name (e.g.
portalauth) - Select region (recommended: EU region for GDPR compliance)[15]
- Assign subscription and create
- Tenant Name: Should reflect the purpose (e.g. "PortalAuth")
- Initial Domain:
[name].onmicrosoft.comis created automatically - Pricing Tier: MAU-based (Monthly Active Users)[5]
Important:
The tenant name cannot be changed after creation. Select a meaningful name.
Register an application for OAuth2/OIDC integration with Power Pages.[8]
- In Entra External ID Tenant navigate to: App registrations > New registration
- Assign name:
PowerPages-Portal - Supported account types: "Accounts in this organizational directory only"
- Add Redirect URI:
https://[portalname].powerappsportals.com/signin-[provider]
- Complete registration
- In App Registration: Certificates & secrets > New client secret
- Assign description:
PowerPages-Integration - Validity period: 12 months (recommended)[14]
- Note Secret Value immediately! (only displayed once)
- Navigate to: API permissions > Add a permission
- Select Microsoft Graph
- Add delegated permissions:[16]
openidprofileemailUser.Read
- Grant Admin Consent
Security:
Never store Client Secret in code or public repositories. Use Azure Key Vault[17] or Power Pages Secure Settings.
Configure the user flows for registration, login and profile management.[9]
- Navigate to: User flows > New user flow
- Flow type: "Sign up and sign in"
- Version: Recommended
- Assign name:
B2C_1_signupsignin - Enable identity providers:
- ✓ Email signup (recommended)
- Optional: Social Identity Providers (Google, Microsoft, etc.)[18]
Define which data is collected during registration:[19]
| Attribute | Collect | Return | Required |
|---|---|---|---|
| Email Address | ✓ | ✓ | Yes |
| Given Name | ✓ | ✓ | Yes |
| Surname | ✓ | ✓ | Yes |
| Display Name | ✓ | ✓ | No |
| Object ID | - | ✓ | - |
- Navigate to: User flows > New user flow
- Flow type: "Password reset"
- Name:
B2C_1_passwordreset - Enable email verification
- Configure return claims (email, objectId)
Tip:
Test each User Flow immediately after creation using the "Run user flow" button in Azure Portal.
Customize the appearance of authentication pages to match your corporate design.[10]
- In User Flow navigate to: Page layouts > Customize
- Select template or upload Custom HTML
- Corporate Branding Elements:
- Logo (recommended: 280x60 px, PNG/SVG)
- Background Image (optional)
- Brand Colors (Primary, Secondary)
- Custom CSS for advanced customizations
- Configure languages (German, English, etc.)[20]
- Save and test changes
Accessibility:
Ensure sufficient contrasts and WCAG compliance[21] for accessible access when using Custom Branding.
Configure MFA policies for enhanced security.[11]
- In User Flow navigate to: Properties > Multifactor authentication
- Select MFA Type:
- Email OTP: Simplest method
- SMS: Requires Phone Number Attribute
- Authenticator App: TOTP-based (highest security)
- MFA Enforcement:
- Off: MFA disabled
- Always on: MFA for all users (recommended)
- Conditional: MFA based on risk (requires Premium)[22]
Recommendation:
Enable MFA at least for administrative accounts. For standard portal users, MFA can remain optional, but should be considered.
Link Entra External ID as Identity Provider with your Power Pages Portal.[12]
- In Power Pages Admin Center: Security > Identity providers
- Click on "Add provider"
- Provider Type: "OpenID Connect"
- Enter configuration:
- Name:
Entra External ID - Authority: [see above]
- Client ID: [see above]
- Client Secret: [see above]
- Redirect URI:
https://[portal].powerappsportals.com/signin-oidc
- Name:
- Configure mapping (Email → Email, Name → Full Name)
- Save and activate
Tip:
After successful integration, disable other Identity Providers (Local Login, Microsoft) to exclusively use Entra External ID.
Perform comprehensive tests before putting the system into production.
- Registration: Create new user and verify email verification
- Login: Sign in with newly created account
- Password Reset: Complete password reset flow
- MFA: Test Multi-Factor Authentication (if enabled)
- Token Claims: Verify all required claims are included in token[23]
- Logout: Test sign-out (Single Sign-Out)
- Error Handling: Test incorrect credentials, expired tokens, etc.
Go-Live Checklist:
The system should only be released for productive users after successful tests in all scenarios.
4. Regular Maintenance Tasks
Monitor authentication activities for anomalies and errors.[13]
- In Entra Portal: Monitoring > Sign-in logs
- Set filter:
- Time range: Last 24 hours
- Status: Failed
- Application: PowerPages-Portal
- Check for anomalies (e.g. multiple Failed Logins from same IP)
- Failed Sign-ins: Should be < 5%
- MAU (Monthly Active Users): For cost tracking[5]
- Sign-in Duration: Performance indicator
- MFA Success Rate: If MFA is enabled
Set up Alert:
Configure Azure Monitor Alerts[24] for unusually high error rates or sign-in activities.
Identify and deactivate user accounts that haven't been used for an extended period.
- In Entra Portal: Users > All users
- Filter: Last sign-in > 90 days[25]
- Export list and coordinate with business department
- Deactivate accounts (do not delete!):
- Select user
- Properties > Account enabled: No
- Update documentation
Note:
Deactivated accounts can be reactivated at any time. Permanent deletion should only occur after explicit approval (GDPR requests)[15].
Renew Client Secrets regularly to comply with security best practices.[14]
- Create new Client Secret (see 3.2)
- Keep both secrets active in parallel
- Switch Power Pages configuration to new secret
- Test (Sign-in, Sign-up)
- Delete old secret after 48 hours
- Document the process
Important:
Coordinate secret rotation with the Power Pages team. Unplanned secret changes lead to authentication failures.
Monitor monthly active users (MAU) and associated costs.[5]
- Pricing Model: Entra External ID is billed based on MAU
- Free Tier: First 50,000 MAU/month free[5]
- Paid Tier: Approx. €0.00325 per MAU beyond that[5]
- In Azure Portal: Cost Management > Cost analysis[26]
- Filter on Entra External ID Resource
- Trend analysis: MAU development over the last 3 months
- Configure budget alerts (optional)
Regularly check for available updates and security patches.
Automatic Updates:
Most updates are performed automatically by Microsoft. Manual adjustments are only required for breaking changes.
5. Monitoring and Troubleshooting
5.1 Dashboard Metrics
| Metric | Normal Value | Alert Value | Action |
|---|---|---|---|
| Failed Sign-ins | < 5% | > 10% | Check sign-in logs, test user flow |
| Sign-in Duration | < 3s | > 10s | Performance analysis, Azure Support |
| Token Errors | < 1% | > 5% | Check token configuration, validate claims |
| MAU Growth | Steady | Sudden Spike | Check for bot activity, cost alert |
5.2 Common Errors and Solutions
AADB2C90118: User forgot password[31]
Cause: User clicked "Forgot password?"
Solution: This is normal behavior. Ensure that the Password Reset Flow is correctly configured.
AADB2C90091: User cancelled flow[31]
Cause: User cancelled the registration or login process
Solution: Check the User Flow design for usability issues. High cancellation rates may indicate UX problems.
Invalid Client Secret
Cause: Client Secret has expired or is incorrectly configured
Solution: Create a new Client Secret and update it in Power Pages (see 4.3).
Redirect URI mismatch
Cause: Redirect URI in App Registration does not match Power Pages
Solution: Align URIs to match exactly (including trailing slash).
6. Best Practices and Security
6.1 Security Best Practices
1. Principle of Least Privilege[32]
Grant only the minimum necessary permissions for service accounts and administrators. Use dedicated admin accounts, not personal accounts.
2. Conditional Access Policies[22]
Use Conditional Access (Premium feature) for risk-based MFA and location-based access control. Block sign-ins from high-risk countries.
3. Client Secret Management[14]
Never save secrets in code or configuration files. Use Azure Key Vault.[17] Rotate secrets every 6-12 months. Document all secret changes.
4. Audit Logging[13]
Enable comprehensive audit logging and retain logs for at least 90 days.[33] Regularly export logs to SIEM systems for long-term retention.
5. Regular Security Reviews
Conduct quarterly security reviews. Check: Active permissions, MFA adoption rate, failed sign-in patterns, inactive accounts.
6.2 Performance Optimization
Enable Token Caching
Configure token caching in Power Pages for reduced latency and fewer roundtrips to Entra ID.[34]
Minimize Claims
Reduce token size by minimizing claims. Request only actually needed user attributes.[23]
CDN for Custom Pages
Host custom branding assets (logo, CSS) on a CDN for faster loading times globally.
6.3 Compliance and Data Protection
GDPR Compliance[15]
Ensure that Entra External ID tenant is hosted in an EU region. Implement processes for GDPR requests (access, deletion, correction). Document all data processing activities.
Data Residency[35]
Select Azure region based on compliance requirements. EU data should remain in EU regions (West Europe, North Europe).
User Consent Management
Implement clear consent flows for data collection. Document all collected data and their purpose. Enable easy opt-out.
7. Frequently Asked Questions (FAQ)
8. Checklists
8.1 Initial Setup Checklist
8.2 Monthly Maintenance Checklist
8.3 Quarterly Security Review Checklist
Summary
After successful initial setup, the administrative effort for Entra External ID is minimal. Most maintenance tasks can be completed in a few hours per month. Automation (alerts, monitoring) further reduces manual effort.
Need Support with Setup?
In a free 30-minute consultation, we analyze your requirements and develop a tailored implementation plan for Entra External ID with Power Pages.
Book Initial Consultation Now