Seamless Migration from Azure AD B2C to Microsoft Entra External ID (Retaining Existing Consents)

Question

Dear Microsoft Support Team,

We are planning to migrate our application from Azure AD B2C to Microsoft Entra External ID. This migration is coupled with a major rebranding effort, including changes to our application’s name and URL. We currently have numerous customers who have granted admin consent to our app on behalf of their organizations, and we are concerned about the potential need for them to re-consent in the new environment.

Current Scenario

1. Existing Setup
   • Our application is registered in Azure AD B2C.
   • Many customers have already integrated their Azure AD tenants with our app, granting admin consent on behalf of their organizations.
2. Upcoming Changes
   • We intend to migrate our current Azure AD B2C setup to Microsoft Entra External ID.
   • A rebranding initiative will change the name and URL of the application.
   • Update our Application in the App Gallery is also needed (new URL, new Name, new authentication endpoint)
3. Key Concern
   • We fear that existing consents may become invalid after the migration and rebranding, forcing each organization’s admin to grant consent again. This would be disruptive and risk losing user trust and adoption.

If retaining consents is not entirely feasible, what alternative approaches might simplify or streamline the admin consent process for our customers? Like registering a second application in the app gallery?

We greatly appreciate any guidance you can offer.

Answer 1

Hello @Nikolai Falke,

Thank you for posting your query on Microsoft Q&A.

Based on your description, I understand that you are planning to migrate your application from Azure AD B2C to Microsoft Entra External ID and are concerned about the potential need for your customers to re-consent in the new environment.

Microsoft Entra External ID is a new and evolving product, and our engineering team is actively working on streamlining the migration process. Currently, it is in the testing phase.

For updates on its availability, please follow: Microsoft Entra External ID: What's New.

At this time, there is no publicly released migration process, as it remains in the testing phase. Once it is released for public preview, detailed migration steps will be documented.

As of now, if you plan to migrate with a new app name and URL when moving the application from Azure AD B2C to Microsoft Entra External ID, existing admin consents will not carry over to the new environment since a new app will need to be created in the External ID tenant. This means that your customers will need to re-grant admin consent in the new environment.

You can create the second application without removing the existing one. This approach allows your customers to grant admin consent to the new application without impacting the existing application.

For more information, you can also refer to this related thread: Microsoft Q&A: Migrating Azure AD B2C to Microsoft Entra External ID.

I hope this information is helpful. Please feel free to reach out if you have any further questions.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Thanks,
Raja Pothuraju.