Supported features in workforce and external tenants

There are two ways to configure a Microsoft Entra tenant, depending on how an organization intends to use the tenant and the resources that you want to manage:

• A workforce tenant configuration is for your employees, internal business apps, and other organizational resources. A workforce tenant uses B2B collaboration in Microsoft Entra External ID for collaboration with external business partners and guests.
• An external tenant configuration is exclusively for External ID scenarios where you want to publish apps to consumers or business customers.

This article gives a detailed comparison of the features and capabilities in workforce and external tenants. For more information about these tenants, see Workforce and external tenant configurations in Microsoft Entra External ID.

General feature comparison

The following table compares the general features and capabilities in workforce and external tenants.

Interface customization

The following table compares the features for interface customization in workforce and external tenants.

Adding your own business logic

You can use custom authentication extensions to customize the Microsoft Entra authentication experience by integrating with external systems. A custom authentication extension is essentially an event listener. When you activate it, it makes an HTTP call to a REST API endpoint where you define your own business logic.

The following table compares the events for custom authentication extensions in workforce and external tenants.

Identity providers and authentication methods

The following table compares the identity providers and methods for primary authentication and multifactor authentication (MFA) in workforce and external tenants.

Authentication methods available in External ID

You can use some authentication methods as the primary factor when users sign in to an application, such username and password. Other authentication methods are available only as a secondary factor. The following table outlines when you can use an authentication method during sign-in, self-service sign-up, self-service password reset, and MFA in External ID.

Method	Sign-in	Sign-up	Password reset	MFA
Email with password
Email one-time passcode
SMS-based authentication
Apple federation
Facebook federation
Google federation
Microsoft personal account (OpenID Connect)
Microsoft Entra ID federation
OpenID Connect federation
SAML/WS-Fed federation

Application registration

The following table compares the features for application registration in each type of tenant.

Access control for applications

The following table compares the features for application authorization in each type of tenant.

Enterprise applications

The following table compares the unique features for enterprise application registration in workforce and external tenants.

Consent and permission features for enterprise applications

The following table shows which consent and permission features are available for enterprise applications in each type of tenant.

OpenID Connect and OAuth2 flows

The following table compares the features for OAuth 2.0 and OpenID Connect authorization flows in each type of tenant.

Authority URL in OpenID Connect and OAuth2 flows

The authority URL indicates a directory that the Microsoft Authentication Library (MSAL) can request tokens from. For apps in external tenants, always use the following format: <tenant-name>.ciamlogin.com.

The following JSON shows an example of a .NET application appsettings.json file with an authority URL:

{
    "AzureAd": {
        "Authority": "https://<Enter_the_Tenant_Subdomain_Here>.ciamlogin.com/",
        "ClientId": "<Enter_the_Application_Id_Here>"
    }
}

Conditional Access

The following table compares the features for Microsoft Entra Conditional Access in each type of tenant.

Terms-of-use policies

The following table compares the features for terms-of-use policies in each type of tenant.

Account management

The following table compares the features for user management in each type of tenant. As noted in the table, certain account types are created through invitation or self-service sign-up. A user admin in the tenant can also create accounts via the admin center.

Password protection

The following table compares the features for password protection in each type of tenant.

Token customization

The following table compares the features for token customization in each type of tenant.

Single sign-on

Single sign-on (SSO) provides a more seamless experience by reducing the number of times a user is asked for credentials. Users enter their credentials once. Other applications can reuse the established session on the same device and web browser without further prompting.

The following table compares the features for SSO in each type of tenant.

Integrated security solutions

Microsoft Entra External ID supports integrated security features and partner solutions to help protect identities across the lifecycle. These capabilities include protection against distributed denial-of-service (DDoS) attacks, prevention of sign-up fraud, and unified monitoring.

You can enable these solutions directly in External ID and access partner integrations through the Microsoft Security Store. This approach allows organizations to deploy trusted security tools quickly without complex setup.

Akamai and Cloudflare

Akamai and Cloudflare provide DDoS protection, bot mitigation, and WAF capabilities. These capabilities help defend applications against malicious traffic, abusive automation, and common web vulnerabilities such as SQL injection, cross‑site scripting, and API‑based attacks.

When you integrate either service with External ID, you can apply these security controls in front of your customer-facing identity flows. This action improves resilience and reduces exposure to credential stuffing and other identity‑targeted threats.

Activity logs and reports

The following table compares the features for activity logs and reports across various types of tenants.

Microsoft Graph APIs

All features that are supported in external tenants are also supported for automation through Microsoft Graph APIs. Some features that are in preview in external tenants might be generally available through Microsoft Graph. For more information, see Manage Microsoft Entra identity and network access by using Microsoft Graph.

Related content

• Planning for customer identity and access management