Could you please define cloud based authentication services Azure AD B2C and B2B with it's uses and their differences if any. Please provide list of web resources if you can.
The uses of Azure AD B2C (Business to Consumer) and Azure AD B2B (Business to Business) are very different. These differences are highlighted in the documentation.
B2C documentation: https://azure.microsoft.com/en-in/services/active-directory-b2c/
Azure Active Directory B2C is a highly available, global, identity management service for consumer-facing applications that scales to hundreds of millions of identities.
In a nutshell, it allows you to authenticate customers using social identities, like Facebook or Microsoft Account, but still within the context of Azure AD.
B2B documentation: https://azure.microsoft.com/en-in/documentation/articles/active-directory-b2b-collaboration-overview/
Azure AD B2B collaboration lets you enable access to your corporate applications from partner-managed identities. You can create cross-company relationships by inviting and authorizing users from partner companies to access your resources.
In a nutshell, it allows you to authenticate corporate users from other companies.
So one is for consumer-facing applications, and one is for business applications.
https://predica.pl/blog/azure-ad-b2b-b2c-puzzled-out/
Azure AD is an identity as a service provider aimed at organization users to provide and control access to cloud resources
Azure AD B2B is not a separate service but a feature in Azure AD. It allows cross-organization collaboration in applications from an identity standpoint.
Azure AD B2C is an independent service for building a consumer application identity repository. If you need a service to handle email or Facebook login – it is there for you.
https://learn.microsoft.com/en-us/azure/active-directory/b2b/compare-with-b2c
B2B collaboration capabilities
Single sign-on (SSO) to all Azure AD-connected apps is supported. For example, you can provide access to Office 365 or on-premises apps, and to other SaaS apps such as Salesforce or Workday.
Partner lifecycle: Managed by the host/inviting organization.
Azure AD B2C stand-alone offering
SSO to customer owned apps within the Azure AD B2C tenants is supported. SSO to Office 365 or to other Microsoft and non-Microsoft SaaS apps is not supported.
Customer lifecycle: Self-serve or managed by the application.
Related
I have two separate web applications, one built with .NET Framework and the other built with .NET Core. Both web applications make up one solution which we ship to our customers. The solution itself is a SaaS subscription-based solution, where users would be able to sign-up with using either a Microsoft/Office 365, GSuite, or organizational account (basic username/password). We would like to restrict sign-up to organizational/business accounts only.
As I understood, Azure B2B is mainly useful when you have something internal and you would like to give external users some limited access to it. Given that I have a multi-tenant SaaS solution, I believe that Azure B2C makes more sense.
Furthermore, in our solution, we would also want the ability for external users to access Tabular Models in Azure Analysis Services and SSRS.
Is access to only organizational accounts, something that can be configured through Azure AD B2C?
Can access be granted to external users to Azure Analysis Services or other Azure tools when using Azure B2C?
You have two options
Option 1, Using Azure AD External identities solution - recommended
You can use newly released self service sign up solution in Azure AD external identities . You can very well restrict sign up to other Azure AD accounts only. However for sign up using other federation systems - you need to try on. I think as of today only Google and Facebook are supported apart from Azure AD.
Option 2, use Azure AD B2C and use app only authentication.
Azure AD B2C consumer accounts are by default not supported by Azure services or Office. But you can use app based authentication to provide these services. Your client app will call your backend api using Azure AD B2C token. Your backend app can perform all auth validations and then call the backend Azure or any other service using app only authentication mode.
Azure AD B2C newbie here. I have a Single Page Application hosted in Azure & it uses Azure Functions. I want to allow users in many organisations to login to my application using their existing corporate email address, & authenticated in their company's Azure AD, which I have no access to.
For instance I want people in company Contoso to access my Azure SPA by logging in with their existing Contoso email addresses "john.smith#contoso.com". Authentication takes place in Contoso's Azure AD.
Do I use the Azure AD B2C Identity Experience Framework & Custom Policy for this? Any guidance would be helpful.
This isn't the best case for use of Azure AD B2C.
I recommend you use the "multi-tenant" pattern to configure your single-page application to accept sign-ins from any Azure Active Directory tenant
I am trying to use MFA for on-premise APPS that are secured by AD and ADFS. We are uing MIM to provision accounts automatically to AD. However all accounts will not be synchronized to Azure AD. I have read following article
https://learn.microsoft.com/en-us/microsoft-identity-manager/pam/use-azure-mfa-for-activation
Does it mean you can use Azure AD MFA withing MIM for on-premise Apps which are secured by ADFS? does it go to Azure AD to challenge the user for MFA? what about if the account exist only in AD not Azure AD?
Appreciate all kind of advice.
The article you cited above is only applicable to the use of Azure AD MFA within MIM for the privileged access management scenario, rather than for MFA for use within applications. I would recommend synchronizing accounts to Azure AD, and using conditional access and the application proxy where applicable. See https://learn.microsoft.com/en-us/azure/active-directory/authentication/concept-mfa-whichversion for more info on the options for applications.
I do not have much experience with AD in general. I have a web app in Azure and I want to authenticate users in the app using Azure AD and I read a bit about Azure AD B2B option but I simply still do not understand it.
What I do now in steps:
Create a new Azure Directory
In that directory I go to Azure Active Directory (service)
Register my application
Go to Users/all Users/ New guest user and add the users of the application
Job done
What is the difference between me doing this and the Active Directory B2B?
Azure AD business-to-business (B2B) collaboration capabilities enable any organization using Azure AD to work safely and securely with users from any other organization, small or large. Those organizations can be with Azure AD or without, or even with an IT organization or without. +
Organizations using Azure AD can provide access to documents, resources, and applications to their partners, while maintaining complete control over their own corporate data. Developers can use the Azure AD business-to-business APIs to write applications that bring two organizations together in more securely. Also, it's pretty easy for end users to navigate.
Enable users from other organization to access the application is one kind of Azure AD B2B. And the Azure AD B2B is enabled by invite the other users to your organization tenant.
More details bout Azure AD B2B, please refer the link below:
What is Azure AD B2B collaboration
I am working on a project to migrate the Consumer faced application to the cloud.
Based on the pricing I prefer to use the Azure AD B2C tenant.
Tentative timeline for the Azure AD B2C GA ?
How can I sync/move the user object from On-premises AD to the Azure AD B2C tenant? Can we use Azure AD connect for this?
As stated in this FAQ,
Can I use Azure AD Connect to migrate consumer identities that are stored on my on-premises Active Directory to Azure AD B2C?
No, Azure AD Connect is not designed to work with Azure AD B2C. We
will provide various migration options and tools out-of-the-box in the
future.
With the (beta) MSAL library (https://github.com/AzureAD/microsoft-authentication-library-for-dotnet), you can add both B2C and your existing AD to your website, so both worlds (external customers in B2C and corporate users in AD) can login to the same site.
from: https://blogs.technet.microsoft.com/enterprisemobility/2016/03/31/microsoft-identity-at-build-2016/
MSAL is a developer library that helps you to obtain tokens from MSA, Azure AD or Azure B2C for accessing protected resources – such as your own API, Microsoft’s API (such as the Microsoft Graph) and any other 3rd party choosing to protect their API with Microsoft identity.