Microsoft Azure → Amazon Web Services
AWS equivalent of Microsoft Entra External ID
The closest AWS equivalent of Microsoft Entra External ID is Amazon Cognito.
About Microsoft Entra External ID
| Provider | Microsoft Azure |
|---|---|
| Status | Generally available Azure AD B2C, the previous customer identity service, has been unavailable to new customers since May 1, 2025. Existing B2C tenants remain supported. |
| What it is | Customer and partner identity. External tenants handle consumer and business-customer sign-up and sign-in with social and enterprise IdPs, and B2B collaboration handles guest access in workforce tenants. |
| Documentation | learn.microsoft.com |
| Pricing | Official pricing page |
AWS mappings (1)
| Capability | AWS equivalent | Match |
|---|---|---|
| Customer identity and access management (CIAM) | Amazon Cognito | Partial match |
Customer identity, directories & app access(1)
Customer identity and access management (CIAM) Partial match
Amazon Cognito user pools map to Microsoft Entra External ID in an external tenant. Azure AD B2C, the older Azure CIAM service, has been unavailable to new customers since May 1, 2025. Cognito identity pools, which swap tokens for AWS credentials, have no direct Azure counterpart.
- Platform. Cognito is a standalone AWS service. External ID runs on the same Microsoft Entra platform as workforce identity, in a separate external tenant, and also covers B2B guest collaboration in workforce tenants.
- Customization. Cognito uses managed login pages, Lambda triggers, and custom auth flows. External ID uses customizable user flows, custom authentication extensions, and branding. Azure AD B2C custom policies (Identity Experience Framework) don't carry over.
- AWS access. Identity pools give app users temporary AWS credentials for S3 or DynamoDB. On Azure, apps usually call their own API, which then uses a managed identity.