Power Pages Authentication with Entra External ID for Citizen and Resident Portals

Public-facing portals have become a core channel for how government agencies and aged care providers interact with the people they serve. Residents check care plans, citizens lodge applications, and families track service updates, all through self-service experiences that need to be secure, reliable, and straightforward to use. When those experiences are built on Microsoft Power Pages, the identity layer that governs sign-in and registration is one of the most consequential design decisions an organisation makes.

Microsoft has signalled a clear direction for external identity by positioning Microsoft Entra External ID as the successor to Azure Active Directory B2C. For teams operating existing portals, this raises practical questions about supportability, migration, and the effect on user flows that citizens and residents already rely upon. Understanding the change now allows organisations to plan an orderly transition rather than reacting under pressure later.

Understanding the shift from Azure AD B2C to Entra External ID

Azure AD B2C has served as Microsoft's customer identity and access management platform for many years, providing external sign-in, custom policies, and identity provider federation for consumer-facing applications. Microsoft has now introduced Entra External ID as the next generation of that capability, consolidating customer identity within the broader Microsoft Entra family. Microsoft has advised that Azure AD B2C is no longer offered to new customers and that existing tenants will continue to be supported for a defined period, which makes forward planning important for organisations with established portals.

Entra External ID is built around the concept of an external tenant, which is a dedicated directory purpose-built for customer and partner scenarios and kept separate from the workforce tenant that manages staff identities. This separation matters for government and aged care providers because it keeps resident and citizen accounts logically distinct from internal employee identities, which supports cleaner governance and clearer administrative boundaries. The platform continues to offer familiar building blocks such as local accounts, social and federated sign-in, self-service registration, and customisable sign-in experiences, while aligning them with the modern Entra administration model.

How Power Pages consumes external identity

Power Pages supports several authentication approaches, and the recommended pattern for external identity relies on the OpenID Connect protocol. When an external identity provider is configured, Power Pages redirects the visitor to that provider to authenticate, then receives a validated token and establishes the portal session against a contact record in Microsoft Dataverse. This model keeps credential handling with the identity platform rather than the portal itself, which reduces the surface area that portal administrators must secure and maintain.

Because Entra External ID exposes standard OpenID Connect endpoints, connecting it to Power Pages follows the same broad configuration pattern that many teams already understand, involving an application registration, a redirect URI, and the relevant authority and client details. The important design work sits around claims mapping, ensuring that the attributes returned at sign-in align with the contact fields Power Pages expects, so that a returning resident is matched to the correct record. Getting this mapping right early avoids duplicate contacts, broken sessions, and confusing experiences for people who may only sign in occasionally.

Planning a migration of existing user flows

Migrating from Azure AD B2C to Entra External ID is not simply a matter of changing a connection string, because user flows, branding, and account data all need careful treatment. Teams should begin by inventorying their current B2C configuration, including the sign-up and sign-in policies, any custom policies, the identity providers in use, and the attributes collected during registration. This inventory becomes the specification against which the equivalent Entra External ID user flows are designed, and it surfaces any customisations that may need to be reworked rather than transferred directly.

Account migration deserves particular attention, since residents and citizens will already hold accounts that must continue to function after the change. Local accounts that use passwords cannot have their password hashes freely moved between platforms, so organisations typically plan for approaches such as staged migration or a password reset experience on first sign-in, communicated clearly to affected users in advance. A parallel-run approach, where the new configuration is validated in a non-production environment against representative test accounts, helps confirm that claims, redirects, and Dataverse matching all behave correctly before any cutover affects live users.

Sovereignty and compliance considerations for Western Australia

Government agencies and aged care providers in Western Australia operate under expectations around data residency, privacy, and information security that shape any identity decision. Microsoft Entra is a global identity service, so organisations should confirm where relevant identity data is stored and processed, and document those findings against their own obligations under state information management policy and the Privacy Act. Aligning the design with recognised guidance, such as the Australian Cyber Security Centre's Essential Eight and its advice on multifactor authentication, helps demonstrate that the portal meets a defensible security baseline.

Beyond residency, the choice of external identity platform affects how an organisation enforces controls such as multifactor authentication, conditional access, and account recovery for external users. Entra External ID brings customer identity closer to the wider Entra tooling that many agencies already use for workforce identity, which can simplify how security policies are reasoned about and audited across the environment. Treating the migration as an opportunity to review these controls, rather than a like-for-like technical swap, allows organisations to strengthen the overall posture of their citizen and resident portals while remaining on a supported Microsoft path.

References

• Microsoft Entra External ID documentation
• Configure an OpenID Connect provider for Power Pages
• ACSC Essential Eight