ExternalIdentities

Name: ExternalIdentities API
Brand: ExternalIdentities
Availability: InStock

✓ Official Vendor SpecIdentity AuthDirectory Servicesoauth220 EndpointsREST

For Agents

Provision Azure AD B2C tenants, manage Azure AD for Customers (CIAM) directories, and track Guest Usages from one ARM-based identity surface.

Quickstart

Get started with ExternalIdentities in minutes using your preferred integration method.

# Add to your MCP client config (Claude Desktop, Cursor, Windsurf)
{
  "jentic": {
    "url": "https://api.jentic.com/mcp",
    "auth": "oauth"
  }
}

# Then ask your agent:
"create an azure ad b2c tenant"

# → Jentic returns the GET /events tool with parameter schema, agent executes.

Capabilities

What an agent can do with ExternalIdentities API.

Create and manage Azure AD B2C tenant resources scoped to a subscription and resource group

Provision Azure AD for Customers (CIAM) directories for new customer-facing identity stacks

Check whether a B2C or CIAM tenant name is available before attempting to create one

List and inspect Guest Usages resources to track external collaboration

GET STARTED

Start building with ExternalIdentities API

Explore with Jentic

View OpenAPI Document

The Azure AD B2C ExternalIdentities API manages the ARM resources behind Azure AD B2C tenants, Guest Usages, and Azure AD for Customers (CIAM) directories. It exposes 20 operations across 11 resource paths under the Microsoft.AzureActiveDirectory provider, covering tenant create-or-update, listing tenants per subscription or resource group, name availability checks, guest usage tracking, and CIAM directory lifecycle. Use it to provision new B2C or CIAM directories, audit guest collaboration usage, and check tenant name availability before creation.

Use Cases

Patterns agents use ExternalIdentities API for, with concrete tasks.

★ Provision a customer-facing identity stack

Stand up a new Azure AD B2C or Azure AD for Customers tenant as part of launching a new product. The API supports name availability checks before creation and full lifecycle on b2cDirectories and ciamDirectories so the whole flow can be scripted from infrastructure-as-code.

Check availability of contoso-b2c via checkNameAvailability and, if free, create a B2C tenant named contoso-b2c in resource group identity-rg.

Tenant inventory and ownership audit

Inventory every B2C and CIAM directory across an Azure subscription to confirm ownership, region, and SKU. The list-by-subscription endpoints make it possible to feed governance dashboards with directory metadata without manual portal sweeps.

List all b2cDirectories and ciamDirectories in subscription 00000000-0000-0000-0000-000000000000 and report each one's SKU and location.

Guest collaboration usage reporting

Track Guest Usages resources across a subscription to understand external collaboration and Azure AD B2B traffic. The guestUsages endpoints expose per-tenant resource records that finance and IT teams can use for billing and policy enforcement.

List all guestUsages resources in subscription 00000000-0000-0000-0000-000000000000 and return the tenants with non-zero monthly active users.

Agent-driven identity provisioning

Let an AI agent take a request like 'spin up a new B2C tenant for project X' and run name availability, tenant creation, and a CIAM directory in parallel through Jentic. Surfacing the ExternalIdentities operations as agent tools turns identity provisioning into a chat-driven workflow.

Search Jentic for 'check azure ad b2c tenant name availability', load the schema, and execute it for the candidate name 'contoso-b2c'.

Key Endpoints

20 endpoints — the azure ad b2c externalidentities api manages the arm resources behind azure ad b2c tenants, guest usages, and azure ad for customers (ciam) directories.

METHOD

PATH

DESCRIPTION

POST

/subscriptions/{subscriptionId}/providers/Microsoft.AzureActiveDirectory/checkNameAvailability

Check B2C/CIAM tenant name availability

GET

/subscriptions/{subscriptionId}/providers/Microsoft.AzureActiveDirectory/b2cDirectories

List B2C directories in a subscription

GET

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.AzureActiveDirectory/b2cDirectories/{resourceName}

Get a B2C directory by name

GET

/subscriptions/{subscriptionId}/providers/Microsoft.AzureActiveDirectory/ciamDirectories

List CIAM directories in a subscription

GET

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.AzureActiveDirectory/ciamDirectories/{resourceName}

Get a CIAM directory by name

GET

/subscriptions/{subscriptionId}/providers/Microsoft.AzureActiveDirectory/guestUsages

List Guest Usages across the subscription

GET

/providers/Microsoft.AzureActiveDirectory/operations

List available AzureActiveDirectory operations

POST

/subscriptions/{subscriptionId}/providers/Microsoft.AzureActiveDirectory/checkNameAvailability

Check B2C/CIAM tenant name availability

GET

/subscriptions/{subscriptionId}/providers/Microsoft.AzureActiveDirectory/b2cDirectories

List B2C directories in a subscription

GET

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.AzureActiveDirectory/b2cDirectories/{resourceName}

Get a B2C directory by name

GET

/subscriptions/{subscriptionId}/providers/Microsoft.AzureActiveDirectory/ciamDirectories

List CIAM directories in a subscription

GET

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.AzureActiveDirectory/ciamDirectories/{resourceName}

Why though Jentic?

Three things that make agents converge on Jentic-routed access.

Credential isolation

Azure AD OAuth tokens for `azure_auth` are stored encrypted in the Jentic vault (MAXsystem). Agents receive scoped, short-lived bearer tokens — refresh tokens and client secrets never enter the agent context.

Intent-based discovery

Agents search Jentic by intent (e.g. 'create azure ad b2c tenant') and Jentic returns the matching b2cDirectories operation with its full input schema, so the agent can call the right ARM endpoint without browsing Microsoft docs.

Time to first call

Direct integration: 1-2 days to handle Azure AD auth, ARM polling, and the B2C/CIAM resource shapes. Through Jentic: under 1 hour — search, load schema, execute.

Related APIs

Alternatives and complements available in the Jentic catalogue.

Alternative

Azure AD Domain Services

Managed domain services for traditional AD-joined workloads

Choose Domain Services for Active Directory compatibility (LDAP, NTLM, Kerberos); choose ExternalIdentities for customer-facing B2C/CIAM identity.

Complementary

Intune Resource Management Client

Manage device and app policies that complement identity

Use Intune to enforce device compliance for users authenticated through B2C or CIAM.

Complementary

Azure Resource Graph

Query B2C and CIAM directories at scale across subscriptions

Use Resource Graph to inventory existing B2C/CIAM directories before creating new ones.

FAQs

Specific to using ExternalIdentities API through Jentic.

What authentication does the Azure AD B2C ExternalIdentities API use?

The API uses Azure Active Directory OAuth 2.0 via the implicit flow scheme `azure_auth`, scoped to user_impersonation against https://management.azure.com. Through Jentic the OAuth token stays in the vault and only short-lived scoped bearer tokens are exposed to the agent.

Can I create a new B2C tenant with this API?

Yes. PUT on /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.AzureActiveDirectory/b2cDirectories/{resourceName} creates or updates a B2C tenant. Combine it with a checkNameAvailability call first to confirm the requested name is free.

What are the rate limits for this API?

The spec does not declare explicit rate limits. Calls go through Azure Resource Manager, which applies standard ARM throttling per subscription. Inspect the x-ms-ratelimit-remaining-subscription-* response headers to track quota.

How do I check tenant name availability through Jentic?

Search Jentic for 'check azure ad b2c tenant name availability', load the schema for POST /subscriptions/{subscriptionId}/providers/Microsoft.AzureActiveDirectory/checkNameAvailability, and execute it with the candidate name. Install with `pip install jentic` and use the async search/load/execute pattern.

What is the difference between b2cDirectories and ciamDirectories?

b2cDirectories manage classic Azure AD B2C tenants. ciamDirectories manage the newer Azure AD for Customers (CIAM) resource type, which is Microsoft's next-generation customer identity offering. The API supports both so you can pick whichever model fits the product.

Does this API manage user accounts inside a B2C tenant?

No. This API only manages the tenant resource itself. User accounts, custom policies, identity providers, and sign-in flows inside a B2C tenant are managed via the Microsoft Graph API and the B2C policy framework, not through this ARM surface.