in this video I go over the difference
between Azure b2b and b2c services hello
everyone I'm Travis and this is
Ciraltos and today I'm going over the
difference between Azure business to
business or b2b and business to customer
or b2c services before that please take
a second to subscribe like share and
click the bell icon to get notifications
of new content I chose this topic
because I remember being confused by
this and a couple certification exams I
previously took b2b and b2c are two
different identity services but their
names are similar I remember having this
on my list of items to review while
sitting in the parking lot of my testing
center back when you could use testing
centers the difference is pretty easy
once you understand what they're for
we'll start with b2b but before that
let's review how Azure handles
authentication and authorization if you
come from a Windows background it's easy
to think of authorization and
authentication as two parts to the same
thing user objects have password hashes
defined group membership and other
security related attributes with Azure
Microsoft did something different
they split authentication and
authorization and to authentication is
the act of proving who you are
well authorization defines what you can
do to take things even further an object
does not need to be from the azure ad
tenant to be authenticated
because authentication and authorization
are split into two users from other
tenants can login and get authorized to
items in your tenant that brings us to
business-to-business b2b allows you to
share your organization's applications
and services to guests from outside your
organization this allows your business
to collaborate with other businesses
that's the business-to-business part
users use their native identities for
access to items in your tenant
let's see how this works a user is
located in company a Company B is a
partner with resources that they would
like to share so they send an invite to
the user the resources could be access
to an azure object or an O 365 service
like SharePoint or teams the user
accepts the end
and by doing so a guest object is
created in company B's Azure tenon
representing that user the users granted
authorization to the resourcing company
be the user's authentication takes place
in company eight but authorization what
they can access takes place in Company B
this works the same with public
identities like Google and outlook.com
let's do a quick walk through of setting
this up Here I am at the portal and the
first thing I'm going to do is go into
Azure Active Directory from here I'm
gonna go to users next I'll go to a new
guest user I'm going to invite a user
I'll give the user a name I'll just use
Travis guest for this example I'll give
it the email address of the user and
I'll fill out the name fields I can give
a personal message I'll scroll down here
I can add the user to a group or assign
a role we can do that later too if I
wanted to block sign in until this has
been accepted I can set that here you
can also give it a location this user is
in the United States and I'll give a job
title now I'll click invite that will
send an invite to the user I'm gonna go
into the account and just point out a
couple things you can see here under the
identity under invitation accepted
there's no I can also resend the
invitation if the user didn't get it or
lost it for some reason next I'm going
to log into the users email account and
accept the invitation here's the
invitation I'm invited to join the
default directory I'm going to click on
that and in order to accept the
invitation I'll click on the link this
will have me sign into Microsoft comm
with my gmail account and this will work
with other public email addresses like
Outlook comm as well as enterprise email
addresses they'll ask me to review and
accept permissions
except and now I can sign into that
directory let's go back to the portal
and see what changed I'm gonna go back
to users and go into the user here you
can see the invitation has been accepted
if I scroll down notice I can edit these
settings so I can block Simon if I
wanted to or update information on the
user also if I go to assign roles I can
add a role assignment to that user
now that user is a directory reader
that's how you add and manage a business
of business or guest account in Azure ad
let's move on to business to customer
b2c provides an identity service for
applications that lets customers choose
how they want to log in while b2b is for
guests access to your tenant b2c is a
customizable identity solution for
customer facing applications
buta C allows customers to sign into
applications by creating an account or
using one they already have external
accounts could be from public emails or
social media accounts such as Gmail
Facebook or Twitter or company IDs why
is this important let's say an
organization creates an application for
public use this application needs
identities for logging in to do that
they would need some kind of identity
database with username and passwords
they would need to create an onboarding
process for new users setup and people
forget their password sometimes so they
need some sort of password self-service
reset if their sensitive information in
the application they may want to provide
multi-factor authentication this would
all need to be secured yet publicly
accessible for the application
nobody wants a database of customer
username and passwords to get hacked we
haven't even talked about allowing
third-party identity providers like
Gmail and Facebook to process logins or
single sign-on all this is provided by
asher b2c allowing developers to spend
more time on application development and
less time on managing and identity
service here's how it works
Azure b2c creates a tenant to
represent the directory of users this is
similar to but different from an azure
ad tenant applications register to the
tenant and uses reg
as local accounts or with external
identities using protocols like Olaf and
open ID or with social identity such as
Twitter Facebook and Gmail fall for
common tasks such as user signup where
custom policies are applied to those
users there are three different types of
accounts and Azure ad b2c directory one
type is a work account these are
accounts native to the tenant used to
manage the tenant and the user accounts
in it there are guest accounts this is
an external account these are also used
to manage the tenant for example you
could invite users from your enterprise
ad tenant to manage the b2c tenant
customer accounts are the accounts uses
krei when they sign up for the
application or service there are two
types of customer accounts local these
are sourced from the b2c tenant and
social or enterprise identities these
are managed from external sources such
as Facebook Gmail or ad FS so to boil it
down to one slide the difference between
b2b and b2c is that b2b allows external
or guest accounts access to resources in
your a charade e or o 365 environment
this is an option to allow external
collaboration with o365 services such as
SharePoint or teams allow external
developers to access Azure DevOps or
give MSPs access to help administer
edger the guest accounts can be sourced
from other businesses or social accounts
such as Facebook or Gmail b2c on the
other hand is an identity solution for
applications developers can leverage b2c
instead of creating their own solutions
to manage customer identities unlike b2b
b2c creates a dedicated azure ad tenant
users can sign in by creating a local
account in that directory or by using an
enterprise or social media account this
was a high-level overview of b2b and b2c
for those planning on taking a Microsoft
Azure certification or someone who's
evaluating and designing Azure
solutions there are a lot more details
on each left to be explored I'll leave
some helpful links below I hope you
found this useful thanks for watching
[Music]