canonical: https://jentic.com/apis/azureadb2c/azureadb2c

# Azureadb2c ExternalIdentities

The Azure AD B2C ExternalIdentities API manages the ARM resources behind Azure AD B2C tenants, Guest Usages, and Azure AD for Customers (CIAM) directories. It exposes 20 operations across 11 resource paths under the Microsoft.AzureActiveDirectory provider, covering tenant create-or-update, listing tenants per subscription or resource group, name availability checks, guest usage tracking, and CIAM directory lifecycle. Use it to provision new B2C or CIAM directories, audit guest collaboration usage, and check tenant name availability before creation.

## For AI agents

Provision Azure AD B2C tenants, manage Azure AD for Customers (CIAM) directories, and track Guest Usages from one ARM-based identity surface.

## Scope

Does not manage users, custom policies, or identity providers inside a B2C tenant - use only for the ARM-level lifecycle of B2C tenants, CIAM directories, and Guest Usages.

## Capabilities

- Create and manage Azure AD B2C tenant resources scoped to a subscription and resource group
- Provision Azure AD for Customers (CIAM) directories for new customer-facing identity stacks
- Check whether a B2C or CIAM tenant name is available before attempting to create one
- List and inspect Guest Usages resources to track external collaboration
- Audit B2C and CIAM tenants across a subscription for governance and ownership reporting

## Use cases

### Provision a customer-facing identity stack

Stand up a new Azure AD B2C or Azure AD for Customers tenant as part of launching a new product. The API supports name availability checks before creation and full lifecycle on b2cDirectories and ciamDirectories so the whole flow can be scripted from infrastructure-as-code.

Example prompt: Check availability of contoso-b2c via checkNameAvailability and, if free, create a B2C tenant named contoso-b2c in resource group identity-rg.

### Tenant inventory and ownership audit

Inventory every B2C and CIAM directory across an Azure subscription to confirm ownership, region, and SKU. The list-by-subscription endpoints make it possible to feed governance dashboards with directory metadata without manual portal sweeps.

Example prompt: List all b2cDirectories and ciamDirectories in subscription 00000000-0000-0000-0000-000000000000 and report each one's SKU and location.

### Guest collaboration usage reporting

Track Guest Usages resources across a subscription to understand external collaboration and Azure AD B2B traffic. The guestUsages endpoints expose per-tenant resource records that finance and IT teams can use for billing and policy enforcement.

Example prompt: List all guestUsages resources in subscription 00000000-0000-0000-0000-000000000000 and return the tenants with non-zero monthly active users.

### Agent-driven identity provisioning

Let an AI agent take a request like 'spin up a new B2C tenant for project X' and run name availability, tenant creation, and a CIAM directory in parallel through Jentic. Surfacing the ExternalIdentities operations as agent tools turns identity provisioning into a chat-driven workflow.

Example prompt: Search Jentic for 'check azure ad b2c tenant name availability', load the schema, and execute it for the candidate name 'contoso-b2c'.

## Key endpoints

| Method | Path | Description |
| --- | --- | --- |
| POST | `/subscriptions/{subscriptionId}/providers/Microsoft.AzureActiveDirectory/checkNameAvailability` | Check B2C/CIAM tenant name availability |
| GET | `/subscriptions/{subscriptionId}/providers/Microsoft.AzureActiveDirectory/b2cDirectories` | List B2C directories in a subscription |
| GET | `/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.AzureActiveDirectory/b2cDirectories/{resourceName}` | Get a B2C directory by name |
| GET | `/subscriptions/{subscriptionId}/providers/Microsoft.AzureActiveDirectory/ciamDirectories` | List CIAM directories in a subscription |
| GET | `/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.AzureActiveDirectory/ciamDirectories/{resourceName}` | Get a CIAM directory by name |
| GET | `/subscriptions/{subscriptionId}/providers/Microsoft.AzureActiveDirectory/guestUsages` | List Guest Usages across the subscription |
| GET | `/providers/Microsoft.AzureActiveDirectory/operations` | List available AzureActiveDirectory operations |

## Key resources

- **B2CDirectories** — Manage Azure AD B2C tenant resources
- **CIAMDirectories** — Manage Azure AD for Customers (CIAM) directories
- **GuestUsages** — Track Azure AD B2B guest collaboration usage
- **CheckNameAvailability** — Verify B2C or CIAM tenant name availability
- **Operations** — List available Microsoft.AzureActiveDirectory operations

## AI readiness

This API is usable in Jentic One now. Its AI-readiness score against Jentic's framework shows where it stands today and where improvements would make it even easier for agents to use.

- **Score:** 46 / 100
- **Maturity:** Foundational
- **Dimensions:**
  - Foundational Compliance: 45 / 100
  - Developer Experience & Jentic Compatibility: 63 / 100
  - AI-Readiness & Agent Experience: 27 / 100
  - Agent Usability: 94 / 100
  - Security: 35 / 100
  - AI Discoverability: 100 / 100
- **View full report:** https://jentic.com/apis/azureadb2c/azureadb2c/scorecard
- **How the score is calculated:** https://docs.jentic.com/reference/api-readiness-framework/overview/
- **More about the dimensions:** https://docs.jentic.com/reference/api-readiness-framework/specification/#dimensional-model-overview

### Score it yourself

Every API in the directory is allowlisted, so you can re-score it with no key required.

- **Score your own API:** https://jentic.com/scorecard.md
- **Scoring CLI agent skill:** https://github.com/jentic/jentic-api-scorecard/blob/main/skills/jentic-api-scorecard/SKILL.md

```sh
npx @jentic/api-scorecard-cli score <openapi-url>
```

## Why Jentic

- **Setup:** Provisioning Azure AD B2C and CIAM directories by hand means acquiring Azure Active Directory OAuth 2.0 tokens, targeting the management.azure.com ARM control plane, and threading subscription, resource group, and tenant names through every Microsoft.AzureActiveDirectory path yourself. Through Jentic you install once, import ExternalIdentities from the API Directory, store the Azure AD credential once, and your agent calls it.
- **Permission scoping:** This API carries the subscription, resource group, and directory name in the URL path (`/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.AzureActiveDirectory/b2cDirectories/{resourceName}`), so a rule can pin your agent to one directory or resource group and nothing else. You choose the operations it may call, so tenant deletion is not included unless you add it.
- **Credential handling:** Your Azure AD token is stored once, encrypted, by your own Jentic One instance and injected at execution time. It never enters the agent's prompt, logs, or context.
- **Discovery method:** Agents search Jentic by intent such as 'create an Azure AD B2C tenant' or 'list CIAM directories in a subscription', and Jentic returns the matching b2cDirectories or ciamDirectories operation with its input schema so the agent calls the right ARM endpoint without browsing Microsoft docs.

## Related APIs

- **Azure AD Domain Services** — Managed domain services for traditional AD-joined workloads
- **Intune Resource Management Client** — Manage device and app policies that complement identity
- **Azure Resource Graph** — Query B2C and CIAM directories at scale across subscriptions

## FAQ

### What authentication does the Azure AD B2C ExternalIdentities API use?

The API uses Azure Active Directory OAuth 2.0 via the implicit flow scheme `azure_auth`, scoped to user_impersonation against https://management.azure.com. Through Jentic the OAuth token stays in the vault and only short-lived scoped bearer tokens are exposed to the agent.

### Can I create a new B2C tenant with this API?

Yes. PUT on `/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.AzureActiveDirectory/b2cDirectories/{resourceName}` creates or updates a B2C tenant. Combine it with a checkNameAvailability call first to confirm the requested name is free.

### What are the rate limits for this API?

The spec does not declare explicit rate limits. Calls go through Azure Resource Manager, which applies standard ARM throttling per subscription. Inspect the x-ms-ratelimit-remaining-subscription-* response headers to track quota.

### How do I check tenant name availability through Jentic?

Search Jentic for 'check azure ad b2c tenant name availability', load the schema for POST `/subscriptions/{subscriptionId}/providers/Microsoft.AzureActiveDirectory/checkNameAvailability`, and execute it with the candidate name. Install with `pip install jentic` and use the async search/load/execute pattern.

### What is the difference between b2cDirectories and ciamDirectories?

b2cDirectories manage classic Azure AD B2C tenants. ciamDirectories manage the newer Azure AD for Customers (CIAM) resource type, which is Microsoft's next-generation customer identity offering. The API supports both so you can pick whichever model fits the product.

### Does this API manage user accounts inside a B2C tenant?

No. This API only manages the tenant resource itself. User accounts, custom policies, identity providers, and sign-in flows inside a B2C tenant are managed via the Microsoft Graph API and the B2C policy framework, not through this ARM surface.

### Can I limit what my agent is allowed to do with the Azure AD B2C API?

Yes. Because you self-host Jentic One, your own rules decide which operations and credentials the agent may use, and every path in this API carries the subscription, resource group, and directory name (for example `/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.AzureActiveDirectory/b2cDirectories/{resourceName}`), so you can pin the agent to a single directory or resource group and nothing else. You also choose the exact operations it may call, so you can allow read-only work like checkNameAvailability and listing b2cDirectories or ciamDirectories while leaving tenant creation or deletion out entirely. The stored Azure AD token stays inside your own instance and is injected only at execution, never reaching the agent's prompt or logs.