Azure AD B2C to Entra External ID Migration Kit

⚠️ PREVIEW/SAMPLE — Sample implementation of the JIT password migration mechanism.

Migrate users from Azure AD B2C to Microsoft Entra External ID with bulk user export/import and seamless password migration on first login (JIT).

🤖 Use with GitHub Copilot

This repo includes a Copilot skill — open the repo in VS Code and ask Copilot to guide you step by step:

• “Set up B2C migration for my tenant”
• “Run the export/import in Simple Mode”
• “Configure JIT password migration”
• “Deploy migration workers to Azure”
• “Migrate my B2C app MyWebApp to External ID”
• “Transform my B2C API connectors to External ID CAE”

The skill covers the full workflow: setup, bulk migration, JIT configuration, local testing, deployment, monitoring, and app & API connector migration.

⚡ Quick Start

Option A — Interactive wizard (recommended):

.\scripts\Setup-Migration.ps1

Option B — Manual setup: See the Runbook for step-by-step instructions.

Prerequisites: .NET 8.0 SDK, PowerShell 7+, Azure CLI, VS Code with Azurite extension.

Migration Modes

Both modes create users with random passwords + RequireMigration flag. JIT password migration (Azure Function) handles the real password on each user’s first login:

graph LR
    User[User Login] -->|First login| ExtID[Entra External ID]
    ExtID -->|Custom Auth Extension| JIT[Azure Function]
    JIT -->|Validate password via ROPC| B2C[(Azure AD B2C)]
    JIT -->|MigratePassword| ExtID
    style JIT fill:#107c10,color:#fff

Key Features

• Two bulk migration modes — Simple (export/import) or Advanced (queue-based parallel workers)
• JIT password migration — seamless first-login password transfer via Custom Authentication Extension
• MFA phone registration — migrate phone numbers at throttle-safe rates (Advanced Mode)
• App & connector migration — export B2C app registrations and transform API connectors to CAEs