Table of Contents
1. Introduction and Objectives
Objective
This document describes the administrative tasks in managing Microsoft Entra External ID (an external tenant) for integration with Microsoft Power Pages. It clearly distinguishes between one-time setup tasks and ongoing maintenance work.
External ID is not Azure AD B2C
Microsoft Entra External ID is Microsoft's current CIAM solution. It runs in a separate external tenant that you manage in the Microsoft Entra admin center. Azure AD B2C is a separate legacy product: it has not been sold to new customers since May 1, 2025 and is supported until at least May 2030. B2C concepts such as B2C_1_ policies, custom policies (Identity Experience Framework) or AADB2C error codes do not apply to External ID.
Target Audience
IT administrators and identity professionals with basic knowledge of Azure/Entra ID. Technical understanding of OAuth2/OpenID Connect is beneficial but not mandatory.
Initial Setup
Setup Duration
Maintenance Effort
Monitoring
Prerequisites
| Category | Requirement | Required |
|---|---|---|
| Azure Access | Azure subscription (a 30-day free trial tenant is enough for testing) | Yes |
| Permissions | Tenant Creator to create the tenant; admin roles in the external tenant (e.g. Application Administrator) | Yes |
| Licensing | External ID, billed by monthly active users (MAU) via the linked Azure subscription | Yes |
| Power Pages | Power Pages Environment with Admin access | Yes |
| Domain | Custom URL domain for the sign-in pages (optional) | No |
2. Overview: One-Time vs. Regular Tasks
One-Time Setup Tasks
These tasks are performed once during initial setup:
- Create Entra External ID Tenant
- Configure App Registration
- Set up User Flows (Sign-up/Sign-in)
- Configure Company Branding
- Enforce MFA via Conditional Access
- Integration with Power Pages
- Create test users and perform tests
Regular Maintenance Tasks
These tasks occur during ongoing operations:
- Monitor Sign-in Logs
- Review failed authentications
- Deactivate inactive users
- Rotate client secrets (only if you use one)
- Test User Flow updates
- Monitor capacity and costs
- Apply security updates
Important
After successful setup, the administrative effort is minimal. Most activities are limited to monitoring and occasional updates. Portal users reset their passwords themselves; profile data is maintained in Power Pages.
3. One-Time Setup Tasks
Create a dedicated external tenant for portal authentication. External tenants are created in the Microsoft Entra admin center, not in the Azure portal.
- In the Microsoft Entra admin center navigate to: Entra ID > Overview > Manage tenants
- Click on "Create", select "External" and continue
- Choose the 30-day free trial or "Use Azure Subscription"
- Enter tenant name and domain name (e.g.
portalauth) - Select the country/region (for GDPR: an EU country)
- Select subscription and resource group, then create (takes up to 30 minutes)
- Domain:
[name].onmicrosoft.comis created; sign-in runs via[name].ciamlogin.com - Role: Creating the tenant requires at least the Tenant Creator role
- Billing: MAU-based via the linked Azure subscription
Important:
The country/region (data location) and the domain name cannot be changed after creation. Choose carefully.
Register an application in the external tenant for OpenID Connect sign-in with Power Pages.
- In Power Pages design studio: Security > Identity providers
- At "Microsoft Entra External ID" select "Configure", enter a name, click "Next"
- Copy the Reply URL and keep the tab open
- In the external tenant navigate to: App registrations > New registration
- Assign name:
power-pages-app - Redirect URI: platform "Web", paste the Reply URL copied from Power Pages (with a custom domain: the matching URL on your domain)
- Complete registration
- Authentication: enable Access tokens and ID tokens, save
- API permissions: select Grant admin consent
Client secret:
According to the Power Pages documentation, the dedicated "Microsoft Entra External ID" provider only asks for Client ID, Authority, Redirect URL and Metadata address. A client secret is only needed if you connect External ID via the generic OpenID Connect provider with the authorization code flow.
Security:
If you do use a client secret: never store it in code or public repositories. Keep it in a vault such as Azure Key Vault and note the expiry date.
External ID uses one user flow type for sign-up and sign-in. Password reset is part of the sign-in experience, not a separate flow.
- Navigate to: Entra ID > External Identities > User flows > New user flow
- Assign name:
power-pages-user-flow(no prefix required) - Identity providers, Email Accounts:
- Email with password (default) or Email one-time passcode
- Optional: Google, Facebook, Apple or custom OIDC, once configured as identity providers in the tenant
- Select user attributes to collect during sign-up, then "Create"
- In the user flow: Applications > Add application, select
power-pages-app
Define which data is collected during registration:
| Attribute | Collect at sign-up | Required |
|---|---|---|
| Email Address | Yes (always, verified by one-time passcode) | Yes |
| Given Name | Yes | Recommended |
| Surname | Yes | Recommended |
| Display Name | Optional | No |
Attributes are only collected at first sign-up. Which values reach Power Pages is controlled by the app registration (token configuration) and the claims mapping in Power Pages.
- Prerequisite: the user flow uses Email with password
- Navigate to: Entra ID > Authentication methods > Email OTP
- Enable Email OTP for all users (or selected groups) and save
- Users then see the "Forgot password?" link on the sign-in page
Tip:
Test each user flow immediately after creation with "Run user flow" in the Microsoft Entra admin center.
Customize the Microsoft-hosted sign-in pages to match your corporate design. External tenants start with a neutral branding without Microsoft logos.
- Navigate to: Entra ID > Custom Branding, tab "Default sign-in" > "Edit"
- Basics: favicon, background image, page background color
- Layout: template (full or partial screen), header, footer
- Header and sign-in form: logo and banner logo
- Footer: your own links for privacy and terms of use
- Text: custom texts for sign-in and sign-up
- Languages: via language customization in the user flow
Custom CSS is being retired:
Microsoft is phasing out custom CSS for company branding. Tenants created after January 5, 2026 no longer get it. Plan your branding with the built-in options. Custom HTML pages (as known from B2C) do not exist in External ID.
Accessibility:
Ensure sufficient contrast and WCAG compliance for background images and colors.
In external tenants, MFA is enforced with a Conditional Access policy, not with a setting inside the user flow.
- Enable the second-factor methods under Entra ID > Authentication methods:
- Email OTP: simplest method (as a second factor after email and password)
- SMS: available as a paid add-on
- Passkey (FIDO2): phishing-resistant
- Create a policy under Conditional Access > New policy:
- Users: all users, exclude emergency access accounts
- Target resources: the Power Pages app (or all resources)
- Grant: require multifactor authentication
- Enable the policy and test it with a test user
Recommendation:
Enable MFA at least for administrative accounts. For standard portal users, MFA can remain optional, but should be considered.
Power Pages has a dedicated identity provider for External ID. Use it instead of a generic OpenID Connect provider.
Copy the values from App registrations > [your app] > Endpoints instead of building them by hand. B2C-style URLs with a policy name (B2C_1_...) or b2clogin.com do not work for External ID.
- Return to the open tab (design studio: Security > Identity providers > Microsoft Entra External ID)
- Enter configuration:
- Client ID, Authority and Metadata address: [see above]
- Redirect URL: keep the default; with a custom domain, enter the custom URL (must match the redirect URI of the app registration exactly)
- Optional additional settings: external logout, claims mapping, nonce lifetime, use token lifetime, contact mapping with email
- Select "Confirm"
Tip:
Authentication changes can take a few minutes. For immediate effect, restart the site in the Power Pages admin center.
Tip:
After successful integration, disable other Identity Providers (Local Login, Microsoft) to exclusively use Entra External ID.
Perform comprehensive tests before putting the system into production.
- Registration: Create new user and verify email verification
- Login: Sign in with newly created account
- Password Reset: Complete password reset flow
- MFA: Test Multi-Factor Authentication (if enabled)
- Token Claims: Verify all required claims are included in token
- Logout: Test sign-out (Single Sign-Out)
- Error Handling: Test incorrect credentials, expired tokens, etc.
Go-Live Checklist:
The system should only be released for productive users after successful tests in all scenarios.
4. Regular Maintenance Tasks
Monitor authentication activities for anomalies and errors.
- In the Microsoft Entra admin center: Entra ID > Monitoring & health > Sign-in logs
- Set filter:
- Time range: Last 24 hours
- Status: Failed
- Application: PowerPages-Portal
- Check for anomalies (e.g. multiple Failed Logins from same IP)
- Failed Sign-ins: Should be < 5%
- MAU (Monthly Active Users): For cost tracking
- Sign-in Duration: Performance indicator
- MFA Success Rate: If MFA is enabled
Set up Alert:
External tenants keep sign-in and audit logs for only 7 days. Export them via Azure Monitor to a Log Analytics workspace and configure alerts for unusually high error rates there.
Identify and deactivate user accounts that haven't been used for an extended period.
- Identify users without sign-in for more than 90 days (from the sign-in logs exported to Log Analytics, or via Microsoft Graph)
- In the Microsoft Entra admin center: Entra ID > Users
- Export list and coordinate with business department
- Deactivate accounts (do not delete!):
- Select user
- Properties > Account enabled: No
- Update documentation
Note:
Deactivated accounts can be reactivated at any time. Permanent deletion should only occur after explicit approval (GDPR requests).
Only relevant if your configuration uses a client secret (for example a generic OpenID Connect provider with the authorization code flow). The dedicated External ID provider, configured as documented by Microsoft, does not use one.
- Create new Client Secret (see 3.2)
- Keep both secrets active in parallel
- Switch Power Pages configuration to new secret
- Test (Sign-in, Sign-up)
- Delete old secret after 48 hours
- Document the process
Important:
Coordinate secret rotation with the Power Pages team. Unplanned secret changes lead to authentication failures.
Monitor monthly active users (MAU) and associated costs.
- Pricing Model: Entra External ID is billed based on MAU
- Free Tier: First 50,000 MAU/month free
- Beyond that: billed per MAU; premium add-ons (e.g. SMS for MFA) have no free tier. Current prices: official External ID pricing page
- In the Azure portal: Cost Management > Cost analysis on the subscription or resource group linked to the tenant
- Usage also appears there while you are below the free tier
- Trend analysis: MAU development over the last 3 months
- Configure budget alerts (optional)
Regularly check for available updates and security patches.
- Azure Portal: Service Health > Planned maintenance
- Subscribe to Microsoft 365 Message Center
- Follow "What's new" for Microsoft Entra External ID
- Check Security Advisories
Automatic Updates:
Most updates are performed automatically by Microsoft. Manual adjustments are only required for breaking changes.
5. Monitoring and Troubleshooting
5.1 Dashboard Metrics
| Metric | Normal Value | Alert Value | Action |
|---|---|---|---|
| Failed Sign-ins | < 5% | > 10% | Check sign-in logs, test user flow |
| Sign-in Duration | < 3s | > 10s | Performance analysis, Azure Support |
| Token Errors | < 1% | > 5% | Check token configuration, validate claims |
| MAU Growth | Steady | Sudden Spike | Check for bot activity, cost alert |
5.2 Common Errors and Solutions
External ID reports errors as AADSTS codes. Details for any code: https://login.microsoftonline.com/error?code=[number]
AADSTS50126: Invalid username or password
Cause: The user entered wrong credentials
Solution: A certain share is normal. A sudden spike from few IP addresses points to password spraying: check sign-in logs and consider MFA.
AADSTS50053: Account locked or sign-in blocked
Cause: Too many failed attempts, or the request came from an IP address with malicious activity
Solution: Check the failure reason in the sign-in logs. Inform the user; the lockout ends automatically.
AADSTS50011: Redirect URI mismatch
Cause: The redirect URI sent by Power Pages does not match the app registration
Solution: Align both values exactly (scheme, host, path, trailing slash). Typical after switching to a custom domain.
AADSTS700016: Application not found
Cause: Wrong Client ID, or the Authority points to a different tenant
Solution: Compare Client ID and Authority in Power Pages with the app registration in the external tenant.
AADSTS7000215: Invalid client secret
Cause: Only with a client secret: it has expired or the secret ID was entered instead of the value
Solution: Create a new client secret and update it in Power Pages (see 4.3).
6. Best Practices and Security
6.1 Security Best Practices
1. Principle of Least Privilege
Grant only the minimum necessary permissions for service accounts and administrators. Use dedicated admin accounts, not personal accounts.
2. Conditional Access Policies
Use Conditional Access in the external tenant to require MFA or block access. External tenants support a reduced set of options: conditions for device platform and location; grant controls block, require MFA and require password reset. Risk-based conditions (ID Protection) are not available.
3. Client Secret Management
If you use a client secret: never save it in code or configuration files. Use Azure Key Vault. Rotate it every 6-12 months and document all changes.
4. Audit Logging
External tenants keep sign-in and audit logs for 7 days. Export them via Azure Monitor to Log Analytics, a storage account or a SIEM and retain them for at least 90 days.
5. Regular Security Reviews
Conduct quarterly security reviews. Check: Active permissions, MFA adoption rate, failed sign-in patterns, inactive accounts.
6.2 Performance Optimization
Align Session and Token Lifetime
The Power Pages setting "Use token lifetime" aligns the site session with the token lifetime. Decide deliberately whether you want this behavior.
Minimize Claims
Reduce token size by minimizing claims. Request only actually needed user attributes.
Custom URL Domain and WAF
Run sign-in on your own domain (e.g. login.contoso.com) and optionally put a web application firewall in front (Azure Front Door, Cloudflare or Akamai integration).
6.3 Compliance and Data Protection
GDPR Compliance
Select an EU country/region when creating the external tenant; this cannot be changed later. Implement processes for GDPR requests (access, deletion, correction). Document all data processing activities.
Data Residency
The data location of an external tenant is determined by the country/region chosen at creation. Check it against your compliance requirements before you create the tenant.
User Consent Management
Implement clear consent flows for data collection. Document all collected data and their purpose. Enable easy opt-out.
7. Frequently Asked Questions (FAQ)
8. Checklists
8.1 Initial Setup Checklist
8.2 Monthly Maintenance Checklist
8.3 Quarterly Security Review Checklist
Summary
After successful initial setup, the administrative effort for Entra External ID is minimal. Most maintenance tasks can be completed in a few hours per month. Automation (alerts, monitoring) further reduces manual effort.
9. Sources and References
All Microsoft documentation this handbook is based on.
- Microsoft Entra External ID Documentation: https://learn.microsoft.com/en-us/entra/external-id/
- OAuth 2.0 and OpenID Connect Protocols: https://learn.microsoft.com/en-us/entra/identity-platform/v2-protocols-oidc
- Entra ID Built-in Roles: https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/permissions-reference
- Power Pages Administration: https://learn.microsoft.com/en-us/power-pages/admin/admin-overview
- Create an External ID Tenant: https://learn.microsoft.com/en-us/entra/external-id/customers/how-to-create-external-tenant-portal
- Register an Application: https://learn.microsoft.com/en-us/entra/external-id/customers/how-to-register-ciam-app
- Create User Flows in Entra External ID: https://learn.microsoft.com/en-us/entra/external-id/customers/how-to-user-flow-sign-up-sign-in-customers
- Customize Branding: https://learn.microsoft.com/en-us/entra/external-id/customers/how-to-customize-branding-customers
- Enable Multi-Factor Authentication: https://learn.microsoft.com/en-us/entra/external-id/customers/how-to-multifactor-authentication-customers
- Monitor Sign-in Activity: https://learn.microsoft.com/en-us/entra/identity/monitoring-health/concept-sign-ins
- Best Practices for Client Secret Management: https://learn.microsoft.com/en-us/entra/identity-platform/howto-create-service-principal-portal - Microsoft recommends a maximum validity of 12 months.
- GDPR and Microsoft Azure: https://learn.microsoft.com/en-us/compliance/regulatory/gdpr
- Microsoft Graph Permissions Reference: https://learn.microsoft.com/en-us/graph/permissions-reference
- Azure Key Vault Documentation: https://learn.microsoft.com/en-us/azure/key-vault/
- Configure Social Identity Providers: https://learn.microsoft.com/en-us/entra/external-id/customers/how-to-google-federation-customers
- Collect User Attributes: https://learn.microsoft.com/en-us/entra/external-id/customers/how-to-define-custom-attributes
- Language Customization: https://learn.microsoft.com/en-us/entra/external-id/user-flow-customize-language
- Web Content Accessibility Guidelines (WCAG): https://www.w3.org/WAI/WCAG21/quickref/
- Conditional Access in Entra External ID: https://learn.microsoft.com/en-us/entra/identity/conditional-access/overview
- Token Claims Configuration: https://learn.microsoft.com/en-us/entra/identity-platform/optional-claims
- Azure Monitor Alerts: https://learn.microsoft.com/en-us/azure/azure-monitor/alerts/alerts-overview
- Azure Cost Management: https://learn.microsoft.com/en-us/azure/cost-management-billing/costs/
- Azure Service Health: https://learn.microsoft.com/en-us/azure/service-health/
- Microsoft 365 Message Center: https://admin.microsoft.com/Adminportal/Home#/MessageCenter
- Entra ID Release Notes: https://learn.microsoft.com/en-us/entra/fundamentals/whats-new
- Microsoft Security Response Center: https://msrc.microsoft.com/update-guide
- Principle of Least Privilege: https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/best-practices
- Azure Data Residency: https://azure.microsoft.com/en-us/explore/global-infrastructure/data-residency/
- Set up Microsoft Entra External ID with Power Pages: https://learn.microsoft.com/en-us/power-pages/security/authentication/entra-external-id
- Azure AD B2C end of sale (May 1, 2025): https://learn.microsoft.com/en-us/azure/active-directory-b2c/faq#azure-ad-b2c-end-of-sale
- Supported features in workforce and external tenants: https://learn.microsoft.com/en-us/entra/external-id/customers/concept-supported-features-customers
- Enable self-service password reset (external tenants): https://learn.microsoft.com/en-us/entra/external-id/customers/how-to-enable-password-reset-customers
- Multifactor authentication in external tenants: https://learn.microsoft.com/en-us/entra/external-id/customers/concept-multifactor-authentication-customers
- Company branding and custom CSS retirement: https://learn.microsoft.com/en-us/entra/fundamentals/how-to-customize-branding
- Microsoft Entra authentication error codes (AADSTS): https://learn.microsoft.com/en-us/entra/identity-platform/reference-error-codes
- Tokens and claims: endpoints and issuers for external tenants: https://learn.microsoft.com/en-us/entra/identity-platform/security-tokens#token-endpoints-and-issuers
- Data retention (7 days in external tenants): https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-reports-data-retention
- Azure Monitor in external tenants: https://learn.microsoft.com/en-us/entra/external-id/customers/how-to-azure-monitor
- External ID pricing and billing: https://learn.microsoft.com/en-us/entra/external-id/external-identities-pricing
- Configurable token lifetimes: https://learn.microsoft.com/en-us/entra/identity-platform/configurable-token-lifetimes
Need Help with Entra External ID Setup?
Get expert guidance on configuring enterprise-grade authentication for your Power Pages portal.
Book Consultation