Last updated: September 2026
TL;DR
Azure AD B2C stopped being available for purchase by new customers on May 1, 2025. Existing tenants keep running, and Microsoft has said it will support Azure AD B2C until at least May 2030. There is no announced shutoff date, and nothing breaks tomorrow. What changed is the roadmap: Microsoft Entra External ID is the successor product, so B2C is now a platform you are maintaining rather than one you are building on.
The short version for a B2C owner:
- End of sale is not end of life. New customers cannot buy Azure AD B2C. Your existing tenant continues to operate.
- “At least May 2030” is the only support horizon Microsoft has published. It is a floor, not a deadline, and it is not a shutoff announcement.
- Entra External ID is the Microsoft-supported destination. If you want to stay inside the Microsoft ecosystem, that is the path Microsoft is documenting and building.
- The P2 retirement track is separate. Do not fold Azure AD B2C Premium P2 changes into the end-of-sale story. They are different announcements about different things.
- You have roughly four years of runway. That is enough time to make a deliberate architectural decision instead of an emergency one, which is the main reason to start now.
If you already know you are leaving and just want the steps, the canonical walkthrough is Migrating From Azure AD B2C to Keycloak. This post is the timeline and decision context that sits in front of it.
What Microsoft actually announced
There is a lot of secondhand commentary about Azure AD B2C being “killed,” and most of it overstates what Microsoft published. Here is the sourced version, with nothing added.
| Fact | Detail | Source |
|---|---|---|
| End of sale for new customers | Effective May 1, 2025, Azure AD B2C is no longer available to purchase for new customers. Existing customers continue. | Azure AD B2C FAQ, External ID FAQ |
| Support window | Microsoft continues supporting Azure AD B2C until at least May 2030. | Same FAQs |
| Successor product | Microsoft Entra External ID is the next-generation CIAM platform and the documented migration destination. | Plan your migration from B2C to External ID |
| Premium P2 | Azure AD B2C P2 will be discontinued on March 15, 2026 for all customers (tenants continue on P1; this is not a B2C shutoff). Separate track from end of sale. | Azure AD B2C FAQ |
Three things follow from that table, and they matter more than the dates themselves.
End of sale changes the roadmap, not your uptime
An end-of-sale announcement means the product is closed to new revenue. It does not mean the service degrades. Your tenant, your user flows, your custom policies, and your app registrations all keep working exactly as they did on April 30, 2025.
What it does mean is that Azure AD B2C is no longer where Microsoft’s CIAM investment goes. New features, new protocol support, and new integrations land in Entra External ID. If your product roadmap for the next three years assumes your CIAM layer will keep gaining capabilities, that assumption is now wrong for B2C.
“At least May 2030” is deliberately soft
Microsoft’s wording is a commitment to a floor. It is not a scheduled termination. Anyone quoting you a hard B2C shutoff date is inventing it, and you should discount the rest of their analysis accordingly.
The practical reading: you are not in an incident. You are in a planning window. Treat a 2030 floor as “we should land a decision well before the last year of support,” not “we need to cut over this quarter.”
The P2 track is a different conversation
Azure AD B2C Premium P2 has its own messaging, and it is easy to conflate the two because both involve the phrase “Azure AD B2C” and both involve a date. Keep them separate. Microsoft’s B2C FAQ states that Azure AD B2C P2 will be discontinued on March 15, 2026 for all customers; existing tenants continue, with P2-only Identity Protection capabilities going away and billing moving to P1. That is a licensing and feature change on B2C, not an announcement that B2C itself shuts off. If your tenant depends on P2-tier capabilities such as risk-based conditional access on customer identities, evaluate that dependency as its own line item in your inventory, not as evidence that end of sale is arriving sooner than published.
What this actually means for your CIAM stack
The B2C question is rarely just about B2C. It is about the customer identity layer that sits in front of your revenue-generating applications, which is why the decision is harder than a typical infrastructure swap.
Three properties of a CIAM layer make this migration different from moving a database or a queue:
- Every user has a credential you cannot move. Azure AD B2C does not export password hashes through Microsoft Graph or any other API. That is a hard boundary, and it shapes the entire cutover plan. See the canonical migration guide for the three standard ways around it.
- Your flows are encoded in a proprietary format. If you use the Identity Experience Framework, your business logic lives in TrustFramework XML. There is no export path that produces something another platform can consume.
- Failure is instantly customer-visible. A broken CIAM cutover is not a degraded background job. It is every customer unable to sign in, at once, during business hours.
None of that is an argument for panic. It is an argument for using the runway you have.
The three futures for an existing B2C tenant
Every B2C owner ends up in one of three places. The rest of this series works through each in detail, but here is the shape of the decision.
| Path | What it is | Strongest when | Main cost |
|---|---|---|---|
| Stay on B2C | Keep the tenant, do nothing structural, revisit later | Small tenant, simple user flows, no near-term roadmap dependency | Accumulating migration debt on a platform with no feature investment |
| Move to Entra External ID | Migrate to Microsoft’s successor CIAM product | Deep Azure commitment, Microsoft-aligned procurement, you want a vendor-supported path | Per-MAU pricing continues, custom policy logic still needs rework |
| Move to Keycloak | Migrate to open-source, standards-based identity you can self-host or have managed | You want exportable config, no per-MAU billing, and control over where user data lives | You own (or buy) the operational layer |
Staying is a real option, for a while
If you have one sign-up/sign-in flow, a few thousand users, and no social or enterprise federation, staying on B2C through most of the support window is defensible. The cost is that you will do the migration eventually, and you will do it later with less slack.
The signal to watch is not the calendar. It is the first time you need a CIAM capability that B2C will not gain. That is the moment staying stops being free.
Entra External ID is the Microsoft-supported destination
We should be direct about this, because a vendor blog that pretends otherwise is not worth reading. If your organization is standardized on Azure, buys through a Microsoft enterprise agreement, and wants a destination Microsoft supports and documents, Entra External ID is the correct answer. Microsoft publishes migration planning guidance specifically for this move.
What External ID does not change: you are still on per-monthly-active-user pricing, your identity configuration is still a hosted vendor artifact rather than something you own and can export wholesale, and your custom policy logic still has to be reimplemented rather than lifted across.
Keycloak is the exportable path
Keycloak is the open-source option, and the reason teams pick it out of a B2C exit is usually one of three:
- No per-MAU billing. Consumer-facing products with large, low-value-per-user populations are the worst fit for MAU pricing, and CIAM tenants skew that way by definition.
- Configuration you own. A Keycloak realm exports to JSON. You can diff it, commit it, and re-import it somewhere else. That is a materially different lock-in profile from either B2C or External ID.
- Data residency and control. Self-hosting or a managed provider of your choosing decides where customer identity data lives, rather than the vendor’s regional model deciding for you.
The honest trade-off is operational. Keycloak is software you run. Someone has to handle upgrades, high availability, database tuning, and the 3 a.m. page. That is either your platform team or a managed provider. Part 5 of this series covers how that works with managed upstream Keycloak.
A realistic timeline for deciding
Four years of support floor sounds like plenty until you price out the work. Here is how the phases actually sequence for a mid-size tenant.
Phase 1: Inventory (start now, regardless of destination)
You need this artifact no matter which of the three paths you take, and it is the single highest-value thing you can do this quarter.
Document: total users and monthly active users, custom attribute schema, every built-in user flow, every IEF custom policy, every social and enterprise identity provider, every app registration with its redirect URIs and scopes, and every claim your applications depend on.
The inventory is also your honest cost estimate. A tenant with two built-in flows and no IEF is a different project from one with fifteen technical profiles and a REST API claims-enrichment step.
Phase 2: Decide the destination
Run the three-path comparison against your actual inventory rather than against generic feature lists. Part 2 of this series, Azure AD B2C vs Entra External ID vs Keycloak, is the full matrix.
The two questions that decide it for most teams: does per-MAU pricing scale with your revenue or against it, and do you need your identity configuration to be portable?
Phase 3: Map the hard parts
Whatever the destination, custom policies are the labor. Azure AD B2C Custom Policies (IEF) to Keycloak Flows covers the mapping in detail for the Keycloak path.
Phase 4: Dual-run cutover
Do not big-bang a CIAM migration. Run both identity providers, cut applications over in waves, and keep a rollback for every wave. Dual-Run Cutover from Azure AD B2C is the playbook, and the general pattern is in Dual-Run IAM Migration.
Frequently asked questions
Is Azure AD B2C being shut down?
No shutoff date has been published. Azure AD B2C reached end of sale for new customers on May 1, 2025, and Microsoft has stated it will continue supporting the service until at least May 2030. Existing tenants continue to operate normally. Treat “at least May 2030” as a support floor rather than a termination date.
Can I still buy Azure AD B2C?
Not as a new customer. As of May 1, 2025, Azure AD B2C is closed to new purchases. Existing customers with active tenants continue to operate and are not cut off. Microsoft directs new CIAM customers to Entra External ID.
What is the difference between Azure AD B2C and Entra External ID?
Entra External ID is Microsoft’s next-generation customer identity platform and the successor to Azure AD B2C. It is a different product, not a rebrand of the same tenant, which is why Microsoft publishes a migration guide rather than an upgrade button. Migration involves recreating flows, reconfiguring applications, and moving users.
Is the Azure AD B2C P2 retirement the same as end of sale?
No. The Premium P2 track is a separate announcement from the end-of-sale news. Per the Azure AD B2C FAQ, Azure AD B2C P2 will be discontinued on March 15, 2026 for all customers, while B2C itself remains supported until at least May 2030. Evaluate any P2 dependency in your tenant as its own item rather than assuming it moves the end-of-sale timeline.
How long does a migration off Azure AD B2C take?
It depends almost entirely on custom policies. A tenant with built-in user flows only can typically be inventoried, rebuilt, and cut over in a handful of weeks. A tenant with substantial Identity Experience Framework policies, several federated identity providers, and custom claims transformations is a multi-month project, most of which is flow mapping and validation rather than user import.
Do I have to decide now?
No, but the inventory should happen now. The inventory is useful on all three paths, it is the input to any real cost estimate, and it is the piece that gets harder the longer your tenant accumulates one-off policy changes.
Where to go next
The useful reframe: end of sale did not start a clock on your outage, it started a clock on your optionality. A tenant you inventory and understand in 2026 gives you three real choices. A tenant nobody has mapped in 2029 gives you one expensive one.
If Keycloak is on your shortlist and you want to see what the managed version of it looks like before committing to anything, Skycloak runs upstream Keycloak with a 7-day free trial and no credit card required. Nothing in the trial locks you in, which is rather the point of the whole exercise.
Azure AD B2C exit series
This post is Part 1 of a five-part series on leaving Azure AD B2C.
- Azure AD B2C End of Sale and Support Timeline (What Microsoft Actually Said) (this post)
- Azure AD B2C vs Entra External ID vs Keycloak: Three Exit Paths
- Azure AD B2C Custom Policies (IEF) to Keycloak Flows: Mapping Guide
- Dual-Run Cutover from Azure AD B2C: Passwords, Apps, and Rollback
- Skycloak Shorter Path: Managed Upstream Keycloak for Azure AD B2C Teams
For the step-by-step technical walkthrough, see Migrating From Azure AD B2C to Keycloak.