Azure AD B2C is closed to new customers: the alternatives to evaluate

Azure AD B2C is no longer an option for new projects. Microsoft's own documentation says: "Effective May 1, 2025, Azure AD B2C will no longer be available to purchase for new customers." The P2 tier was retired on March 15, 2026, and Microsoft says it will keep supporting existing B2C tenants until at least May 2030. Its recommended successor is Microsoft Entra External ID.

If you are starting a customer identity project, or planning to leave B2C before the support window closes, this is the shortlist and how the options differ.

What to look for in a B2C replacement

Customer identity (CIAM) is not the same as employee SSO. The requirements that decide most projects:

• Sign-up and sign-in flows you can brand, including social providers and email/password.
• SAML and OIDC for B2B customers who bring their own identity provider.
• MFA and passkeys without per-factor add-on pricing.
• A pricing model that survives growth. Per-MAU pricing is cheap at 10,000 users and expensive at 1,000,000.
• Data residency and self-hosting if the customer data cannot leave a region or a network.

The options

Figures are from each vendor's pricing page as of October 2026; check them before you commit, because free tiers change often.

Microsoft Entra External ID

The default choice if you want to stay inside Azure: same tenant model, same portal, same billing relationship. Microsoft positions it as the replacement for B2C, with external tenants for customers and partners. The catch is the same as B2C's: managed only, priced per MAU beyond the free tier, and no self-hosted option for data-residency or air-gapped requirements.

Auth0

The most complete managed CIAM product, with the largest integration catalogue. The free tier covers 25,000 MAU but only one enterprise connection; SAML and OIDC connections for business customers are billed per connection per month, which is the line item that surprises B2B teams. See Auth0 alternatives for the detailed comparison.

Amazon Cognito and Firebase Authentication

Both are attractive if you already live in the ecosystem. Cognito's free tier covers 10,000 MAU, and Firebase's covers 50,000, with enterprise federation metered after a small allowance. Neither is designed for heavy branding or complex B2B flows, and both tie you to their cloud.

Keycloak

The reference open-source option: Apache-2.0, self-hosted, with SAML, OIDC and a large integration ecosystem. Nothing to pay for, but you operate it: upgrades, database, backups, high availability and security patches are your job. It is the closest drop-in replacement for teams that want B2C's protocols without a vendor.

Casdoor

Casdoor is also Apache-2.0 and self-hostable, with OIDC, SAML 2.0, CAS, SCIM, LDAP and 75+ social providers. The cloud version starts at $9 per month with unlimited MAU and no per-connection fees, which is the main difference from the per-MAU, per-connection pricing above. If you are leaving B2C because of cost at scale, that is the comparison worth running.

Zitadel, Logto, authentik

All three are open source with managed options. Zitadel's cloud free tier is measured in daily active users (100), which is much smaller than a 50,000-MAU allowance. Logto's free cloud tier allows 3 applications, with SSO as a paid add-on. authentik is self-host only. They are reasonable when their model matches your scale; see Zitadel alternatives and authentik vs Zitadel.

Migrating off B2C

Microsoft's documented path is the Microsoft Graph API: export users from the B2C tenant and write them into the new system, then recreate the user flows and identity providers. The parts that never migrate automatically:

• Password hashes. B2C does not export them. Plan a password reset, or a gradual migration where users are moved the next time they sign in.
• Custom policies. They are XML trust frameworks specific to B2C; they have to be rebuilt as flows in the new product.
• Sessions. Everyone signs in again after the cutover.

A safe sequence: run the new identity provider in parallel, migrate a small cohort, verify sign-in and MFA for each provider you support, then move the rest and keep B2C read-only until the support window closes.

The short version

If you want managed and Microsoft-native, Entra External ID. If you want the deepest managed feature set, Auth0. If you want to own the data and stop paying per user, Keycloak or Casdoor, with Casdoor also offering a hosted option at a flat monthly price.

Casdoor is open source and self-hostable, with a hosted option from $9 per month and no per-user fees.