Using external identities

So far, we've looked at integrating our corporate users into an Azure AD tenant. However, for may web applications, there will be a need to authenticate customers as well.

Traditionally, this would be provided on a per-application basis using a simple username/password combination stored in a local database. However, given that you may expose multiple applications and you would want to leverage the security benefits we've so far discussed, it would make more sense to leverage the highly secure capabilities of Azure AD.

Of course, what we don't want to do is create user accounts in our domain; they still need to be completely separate from your corporate users. A single authentication mechanism for apps you are responsible for certainly makes sense, both from a management perspective (only having one user database to manage) and from an ease-of-integration perspective—why build a security mechanism for every app?

There are three main...