Azure AD B2C vs Entra External ID vs Keycloak: Three Exit Paths

Last updated: September 2026

TL;DR

If you own an Azure AD B2C tenant, you have three destinations and not one of them is wrong for everybody. Microsoft Entra External ID is the Microsoft-supported successor and the right call for Azure-standardized organizations. Keycloak is the right call for teams who want exportable configuration and no per-monthly-active-user bill. Staying on B2C is defensible for small, stable tenants because support runs until at least May 2030.

The decision compressed:

• Choose Entra External ID if you buy through Microsoft, your identity estate is already Entra-centric, and a vendor-supported destination matters more than pricing model or portability.
• Choose Keycloak if MAU pricing scales against your revenue, you want identity config you can export and version-control, or you need to decide where customer data lives.
• Stay on B2C if the tenant is small, the flows are built-in, and nothing on your roadmap needs a CIAM capability B2C will not gain.
• Do not choose based on the deadline. There is no announced shutoff. Choose on pricing model, portability, and operational appetite.

Context on the timeline is in Part 1, Azure AD B2C End of Sale and Support Timeline. For the Keycloak path specifically, the steps live in Migrating From Azure AD B2C to Keycloak.

The facts that frame the choice

Before comparing, pin down what Microsoft actually published. No invented dates.

• Azure AD B2C reached end of sale for new customers on May 1, 2025. Existing tenants continue (Azure AD B2C FAQ).
• Microsoft will support Azure AD B2C until at least May 2030 (External ID FAQ).
• Microsoft Entra External ID is the successor, with published migration planning guidance.

Note what is missing from that list: any statement that B2C stops working on a given date. If a comparison you are reading leans on urgency, it is selling something.

The three-path matrix

Two rows in that table decide most real cases: pricing model and configuration portability. Everything else tends to be a tiebreaker.

Path 1: Stay on Azure AD B2C

What you get

Nothing changes. Your tenant runs, your flows run, and Microsoft supports the service until at least May 2030. This is the zero-effort option, and zero effort has genuine value when your engineering capacity is committed elsewhere.

When it is the right call

Staying makes sense when all of the following hold:

• You use built-in user flows rather than Identity Experience Framework custom policies.
• Your MAU count is modest and reasonably flat.
• Nothing on your two-year product roadmap depends on a CIAM feature B2C does not already have.
• Your compliance posture does not require data residency control B2C cannot provide.

The real cost

You are accruing migration debt on a platform receiving no feature investment. The bill comes due in two ways.

First, the platform stops moving while identity standards keep moving. New passwordless patterns, new fraud-prevention expectations, and new regional privacy requirements all land in products under active development. B2C is not one of them.

Second, the longer you stay, the more one-off policy changes accumulate in a tenant nobody has fully documented. The migration you do in 2029 is the migration you would have done in 2026, plus three more years of undocumented exceptions.

What to do if you stay

Run the inventory anyway. Document flows, custom attributes, app registrations, and identity providers now, while the people who built them still work there. That artifact is the input to every future decision and it costs you a week.

Path 2: Migrate to Microsoft Entra External ID

What you get

The Microsoft-supported destination. External ID is Microsoft’s next-generation CIAM platform, it is where the CIAM investment goes, and Microsoft publishes explicit guidance for moving B2C tenants to it.

If your organization already runs Entra ID for workforce identity, your procurement goes through a Microsoft enterprise agreement, and your compliance reviews are calibrated to Microsoft’s attestations, External ID removes an enormous amount of organizational friction that has nothing to do with technology.

When it is the right call

• Your identity estate is Entra-centric and your workforce IdP is already Entra ID.
• You want a destination with a vendor SLA and a support contract, and you are willing to pay MAU pricing for it.
• Your team has no appetite for running identity infrastructure and no budget line for a managed third party.
• Your custom policy usage is light, so the rebuild is small.

What it does not solve

Be clear-eyed about what carries over from the B2C experience:

• Per-MAU pricing continues. If the reason you are unhappy with B2C is the bill, changing Microsoft products does not change the billing model. Model your actual MAU curve against External ID pricing before committing.
• It is a migration, not an upgrade. There is no in-place conversion. You recreate flows, reconfigure applications, and move users, which is why Microsoft ships a migration planning document rather than a button.
• Custom policy logic still gets rewritten. IEF TrustFramework XML does not lift and shift into External ID. If your orchestration is complex, you are paying that rebuild cost on either exit path.
• Portability does not improve. Your identity configuration remains a vendor-hosted artifact. If lock-in is the concern, this path does not address it.

Naming precision matters here

Entra External ID (customer identity, the B2C successor) is a different product from Entra ID (workforce identity). If you are researching, make sure the comparison you are reading is about the right one. Our Keycloak vs Microsoft Entra ID comparison covers the workforce product, which is a separate evaluation from this CIAM decision.

Path 3: Migrate to Keycloak

What you get

Upstream Keycloak is open-source identity and access management with full OIDC, OAuth 2.0, and SAML support, identity brokering, and an extension model built on Java SPIs. You can self-host it or have a provider run it for you, and either way the configuration is yours.

The three reasons teams pick it out of a B2C exit

No per-MAU license. CIAM tenants are the worst possible fit for per-user pricing. A workforce IdP bills you for a few thousand employees whose seats map directly to payroll. A customer identity platform bills you for every consumer who signed in this month, including the free-tier users, the trial accounts, and the dormant ones who came back once. Keycloak removes that line item entirely. You pay for compute and either your own operations time or a managed plan, both of which scale with load rather than headcount.

Configuration you can export. A Keycloak realm exports to a JSON file. Clients, flows, identity providers, mappers, and user profile schema all come out in a format you can diff, commit to git, review in a pull request, and import into a different Keycloak anywhere. This is the structural difference from both Microsoft options, and it is why “exportable” is the word that keeps coming up when teams explain the choice.

Control over residency and deployment. You decide which region the customer identity database lives in, which cloud it runs on, and who has administrative access to it. For teams with regional data requirements that do not line up neatly with a vendor’s published regions, this is often the deciding factor rather than a nice-to-have.

The honest trade-off

Keycloak is software that someone operates. Upgrades, high availability, database tuning, certificate rotation, backup verification, and incident response are all real work, and identity is the one service where an outage blocks every other service.

You have two ways to cover that: build the operational capability in-house, or buy managed Keycloak. What you should not do is assume the operational cost is zero because the license cost is. Part 5 of this series, Skycloak Shorter Path, walks through what the managed version covers.

What the migration actually involves

Four phases, and the effort is lopsided:

1. Inventory the tenant. Users, custom attributes, flows, policies, identity providers, app registrations.
2. Map flows to Keycloak. Built-in user flows map cleanly. IEF custom policies do not, and that is where the time goes. See Azure AD B2C Custom Policies (IEF) to Keycloak Flows.
3. Move users and handle passwords. B2C does not export password hashes, so you pick lazy migration, forced reset, or temporary B2C brokering.
4. Cut applications over in waves. Never big-bang. See Dual-Run Cutover from Azure AD B2C.

The full technical walkthrough is the canonical guide: Migrating From Azure AD B2C to Keycloak.

How to actually decide

Generic feature matrices do not resolve this. Four questions do.

1. Does per-MAU pricing scale with your revenue or against it?

Model your MAU curve for the next three years against both Microsoft pricing and a managed Keycloak plan. If your revenue per user is high and your user count is low (B2B SaaS with enterprise seats), MAU pricing is affordable and this question does not decide anything. If your revenue per user is low and your user count is large (consumer apps, marketplaces, freemium products), MAU pricing punishes exactly the growth you are trying to achieve.

2. Do you need your identity configuration to be portable?

If a future migration, a customer contract, or a regulator requires you to demonstrate you can move your identity layer, realm JSON export is a concrete answer and a vendor-hosted configuration is not. If that requirement does not exist for you, this row of the matrix is worth less than it looks.

3. Who operates the identity layer?

Be honest about capacity. A platform team that already runs stateful services in Kubernetes can absorb Keycloak. A four-person product team cannot, and should either buy managed Keycloak or take the SaaS path. Choosing self-hosted Keycloak without the operational capability to back it is the one genuinely bad outcome on this list.

4. How much of your logic is in custom policies?

Count your IEF technical profiles. If the answer is zero, both migration paths are mostly configuration and the decision is purely commercial. If the answer is large, the rebuild cost is significant on both paths, which means it cancels out as a differentiator and you should decide on the other three questions.

Frequently asked questions

Is Entra External ID just Azure AD B2C renamed?

No. External ID is a separate, next-generation product. Moving from B2C to External ID is a migration with flow recreation, application reconfiguration, and user movement, not an in-place rename or upgrade. Microsoft publishes dedicated migration planning guidance for precisely that reason.

Do I have to migrate off Azure AD B2C right now?

No. Microsoft has committed to supporting Azure AD B2C until at least May 2030, and no shutoff date has been announced. The pressure is roadmap pressure rather than availability pressure. Start with the inventory, which is useful on every path.

Is Keycloak actually cheaper than Entra External ID?

It depends on your user count and how you operate it. Keycloak has no per-user license, so at large MAU counts the difference is substantial. At small MAU counts, the infrastructure and operations cost of running Keycloak can exceed a modest SaaS bill. Model both against your real numbers rather than assuming open source is automatically cheaper.

Can I migrate password hashes to either destination?

No. Azure AD B2C does not export password hashes through any API, so the constraint is identical whichever destination you pick. Your options are lazy just-in-time migration (validate against B2C on first login, then store locally), a forced password reset, or brokering through B2C temporarily.

What if I use Entra ID for workforce and want Keycloak for customers?

That is a common and reasonable split. Keycloak brokers Entra ID as an upstream identity provider, so workforce users authenticate through Entra while customer identities live in Keycloak. See Federated SSO vs a Single IdP for the hub pattern and the Skycloak identity providers documentation for configuration.

Where to go next

The three paths are genuinely different bets, not three flavors of the same one. External ID bets on staying inside a supported vendor ecosystem. Keycloak bets on owning your configuration and removing per-user billing. Staying bets that the support floor outlasts the problem.

If the Keycloak path looks right and the operational question is the blocker, Skycloak runs upstream Keycloak as a managed service with a 7-day free trial and no credit card. Upstream means what it says: standard Keycloak, realm export included, so trying it does not create the lock-in you are trying to escape.

Azure AD B2C exit series

This post is Part 2 of a five-part series on leaving Azure AD B2C.

1. Azure AD B2C End of Sale and Support Timeline (What Microsoft Actually Said)
2. Azure AD B2C vs Entra External ID vs Keycloak: Three Exit Paths (this post)
3. Azure AD B2C Custom Policies (IEF) to Keycloak Flows: Mapping Guide
4. Dual-Run Cutover from Azure AD B2C: Passwords, Apps, and Rollback
5. Skycloak Shorter Path: Managed Upstream Keycloak for Azure AD B2C Teams

For the step-by-step technical walkthrough, see Migrating From Azure AD B2C to Keycloak.