Looking for an Azure AD B2C alternative? Logto gives you enterprise SSO, multi-tenant organizations, and MFA without XML custom policies or a rebuild on someone else's timeline.
Azure AD B2C earned its place: a generous free tier, the Azure compliance umbrella, and a 99.99% SLA. But Microsoft has closed it to new customers and now points CIAM projects to Microsoft Entra External ID, a next-generation platform that doesn't run the custom policies teams spent years building. When we talk to teams leaving B2C, the story is rarely one bug. It's a platform that stopped moving while their product kept growing.
| Motivation | What it looks like in practice |
|---|---|
| A product in wind-down mode | Since May 1, 2025, Azure AD B2C is no longer available to new customers, and the Premium P2 tier was discontinued on March 15, 2026. Microsoft commits to supporting existing tenants "until at least May 2030". That leaves time to plan, but every new feature you build on B2C deepens your investment in a platform Microsoft itself has moved past. |
| The upgrade path is not a drop-in replacement | Entra External ID drops XML custom policies entirely, and identity providers configured through custom policies are not supported in a direct migration. Moving there means a new tenant, do-it-yourself user migration scripts against the Graph API, and an app-by-app cutover. If that's the price of the default upgrade, it makes sense to evaluate the whole market instead. |
| Custom policies are a dead end | Advanced B2C scenarios live in the Identity Experience Framework: multiple XML files referencing each other in an inheritance chain, no local debugging, and troubleshooting through Application Insights logs. Microsoft's own FAQ concedes that customers found custom policies "too hard to build and manage". That expertise doesn't transfer anywhere. |
| Enterprise SSO means hand-editing XML | In B2C, federating a SAML identity provider is available only through custom policies. Every enterprise customer you onboard means hand-written claims-provider XML, certificate uploads, and metadata exchanged by hand. There is no self-service portal and no per-customer SSO model to lean on. |
Sign-in experience, MFA, passkeys, and enterprise SSO are configured in the Logto Console or through the Management API. Branding, custom JWT claims, and webhooks cover the scenarios teams used to hand-build in policy XML. Changes take a toggle or an API call, not a policy upload and an Application Insights session.
Logto organizations give each business customer its own members, roles, and enterprise SSO connection, with just-in-time provisioning when their users first sign in. What B2C leaves you to model by hand with custom attributes is a first-class product surface in Logto.
You've seen what happens when a proprietary identity platform reaches end of sale. Logto Cloud is a fully managed service, and it runs the same codebase as Logto's open-source version (13k+ GitHub stars). If the economics or the roadmap ever stop working for you, you can self-host and keep going. No permission needed.
We believe in honest positioning. Logto isn't the perfect fit for every Azure AD B2C customer.
| Logto | Azure AD B2C | |
|---|---|---|
| Key differences | ||
| Product lifecycleWhether the product is open to new customers and actively developed | Actively developedone product line | Closed to new customers since May 2025new features land in a separate product |
| Advanced customizationHow you go beyond the built-in sign-in flows | Console and APIscustom JWT claims and webhooks | XML custom policies (Identity Experience Framework) |
| Enterprise SSOEnterprise customers sign in with their own identity provider | SAML and OIDC connectors configured in the console | SAML federation requires custom policies |
| B2B / multi-tenancyModel business customers as organizations with roles | Unlimited*organizations with roles and per-org SSO | No built-in organization model |
| SPA sessionsKeeping single-page app users signed in | Rotating refresh tokens with configurable lifetime | SPA refresh tokens capped at 24 hours |
| Deployment optionsWhere the auth service can run | Cloud, private cloud, or self-hosted | Microsoft-hosted only |
| Free tierWhat the free plan includes | Up to 50K MAU and 50K tokens | First 50K MAU free |
Based on publicly available information as of July 2026. Please verify with the respective vendor for the latest details.
* "Unlimited" refers to features without a fixed limit, but is subject to system policies to ensure fair usage, security, and optimal performance.
Here's the honest part: Azure AD B2C doesn't let you export password hashes, so no vendor can promise a bulk migration where every existing password silently keeps working. Microsoft's own External ID guidance works around the same constraint.
Everything else moves cleanly. Export user profiles through the Microsoft Graph API and bulk-import them with Logto's Management API. Users who sign in with social providers or passwordless methods won't notice the switch at all.
For password users, plan either a one-time reset or a staged rollout. The right approach depends on your user base, so tell us about your setup and we'll help you plan the cutover.
Read the user migration guide →Every migration is a little different. If the guide doesn't cover your case, talk to us and tell us what you need.
Microsoft doesn't use the word "deprecated", but effective May 1, 2025, Azure AD B2C is no longer available to purchase for new customers, and the Premium P2 tier was discontinued on March 15, 2026. Microsoft states it will continue supporting existing tenants until at least May 2030.
They are separate products, and Microsoft states that External ID is not a new name for Azure AD B2C. External ID is Microsoft's next-generation CIAM platform, and its migration guidance points existing B2C customers there. It does not support XML custom policies; Microsoft has promised a migration path for existing custom policies, but it has not shipped as of July 2026.
Not immediately. Existing tenants are supported until at least May 2030, and Microsoft's stated commitments for B2C cover security, availability, and reliability. New feature work happens in Entra External ID. Since moving there is itself a migration project, many teams treat this as the moment to evaluate the whole CIAM market rather than default to the in-family upgrade.
Microsoft's own successor is Entra External ID, which makes sense for teams deeply invested in the Microsoft ecosystem. If you want multi-tenant B2B features, enterprise SSO without custom policies, and the option to self-host instead of betting on another proprietary lifecycle, Logto is a strong choice. Auth0 and other CIAM vendors are also worth evaluating.
Microsoft, Azure, and Microsoft Entra are trademarks of the Microsoft group of companies. Feature comparisons are based on publicly available information as of July 2026. Please verify with the respective vendor for the latest details.
