Migrating Azure AD B2C P1 to Entra External ID: A 90-Day Runbook

Azure AD B2C did not shut down on 15 March 2026. That date retired Premium P2 (Identity Protection). Remaining P1 tenants stay supported until at least May 2030, frozen: no new features. New work belongs on Microsoft Entra External ID. This runbook is the stay-on-Microsoft path. If you are leaving Azure, use Microsoft Entra alternatives and pick Auth0, Cognito, Ping, or Keycloak instead.

Verify before you act. Read the Azure AD B2C FAQ and the Compass B2C P2 correction. Do not brief the board on a kill-switch that does not exist. Compass last verified this on 19 August 2026.

Phase 1, Correct the timeline and inventory policies (10 days)

Confirm SKU. P2 is gone. P1 is frozen until at least May 2030. You have years, not weeks. Use them. A frozen identity platform does not get passkey orchestration or WebAuthn Level 3.

Inventory every custom policy, user flow, social IdP, and REST API connector. Custom IEF XML does not port. Each policy is a rewrite against External ID's model. High Scale Compatibility exists for large migrations and omits some passkey and social-IdP cases. Read that list before you promise feature parity.

Phase 2, Stand up External ID and map user flows (21 days)

Create the External ID tenant in the same Azure estate so Conditional Access and logging stay in one graph. Map sign-up, sign-in, password reset, and profile edit first. Leave custom policy logic for Phase 4. If the basic user flows cannot run, the XML estate will not either.

Connect Microsoft 365 / Entra workforce only if you need that graph. External ID is customer identity. Workforce Entra ID is a different product. See Okta CIAM for the same class of naming trap.

Phase 3, Pilot a non-custom-policy surface (21 days)

Pick one app that uses user flows, not custom XML. Dual-run. Measure login success, social IdP, and password reset. If this pilot fails, the custom-policy estate will fail louder. Fix claims and redirect URIs here.

Phase 4, Rebuild remaining custom policies (24 days)

This is the program. Each IEF policy becomes External ID user flows, custom authentication extensions, or Azure Functions. There is no XML importer. Staff it as engineering, not as a wizard.

Passkeys: External ID orchestration is 3/5 on Compass. Do not expect MojoAuth-level enrollment from this move. If passkeys are why you are migrating, you may be on the wrong destination. See passkey orchestration 2026.

Phase 5, Cutover and freeze the B2C tenant (14 days)

Point production at External ID. Keep the B2C tenant read-only until rollback is impossible. Do not delete it in this window. Microsoft's P1 support clock is the backstop, not a reason to linger on a frozen platform.

Related: Entra External ID profile, Cognito vs Entra, best CIAM 2026.