Azure AD B2C to Entra External ID (EEID) migration tools

Image showing migration

The tooling docs for B2C migration are here.

There is now a whole set of tools to help you with your migration.

In addition, EEID has new features, e.g. passkeys, email and SMS one-time passcode (OTP) MFA, social identity providers via browser-delegated (web-view) flows, single sign-on (SSO) from native apps to web views, refresh token transfer to Apple Watch and HSC Mode, to help.

As per the docs, two primary migration paths are now generally available.

Just-in-Time (JIT) Migration

Generally available

This works for customers seeking a clean cutover with minimal disruption to users.

The approach migrates users progressively as they sign in — no bulk password reset required.

This enables full EEID feature parity from day one with minimal user impact.

The docs are here.

High-Scale Compatibility (HSC) Mode

Generally available

This works for high-scale environments (5 million+ users) or complex architectural constraints

This approach moves application traffic to EEID first.

It supports the parallel operation of B2C and EEID during transition, reducing cutover risk.

Essentially, B2C and EEID share the same user base and the same applications. You can, e.g. sign up using one and sign in using the other.

My post on HSC is here.

General

“Choosing between JIT and HSC is less about technical capability and more about migration priorities.

JIT prioritises user experience and simplicity, while HSC prioritises scale and operational continuity.

There is also a comprehensive migration guide and architecture blueprint covering end-to-end migration scenarios, credential migration approaches, and application sequencing guidance”.

If you are thinking about migrating, now is a good time to make a list of which applications to migrate, which custom policies to replace, which users to migrate, what to do about security (e.g., CA), and the best approach to take.

Then put together a PoC to guide you along the next steps.

This is also a migration kit, documented here.

The JS / CSS support in EEID is not as wide-ranging as B2C. One way to handle this is to create your own sign-in/out pages (where you are free to do whatever you want) and then use native auth for authentication.

All good!