| Intended for |
To be able to authenticate users from a partner organization, regardless of identity provider. |
Inviting customers of your mobile and web apps, whether individuals, institutional or organizational customers into your Azure AD. |
| Identities supported |
Employees with work or school accounts, partners with work or school accounts, or any email address. (Soon to support) direct federation. |
Consumer users with local application accounts (any email address or user name) or any supported social identity with direct federation. |
| Which directory the partner users are in |
Partner users from the external organization are managed in the same directory as employees, but annotated specially. They can be managed the same way as employees, can be added to the same groups, and so on. |
In the application directory. Managed separately from the organization’s employee and partner directory (if any). |
| Single sign-on (SSO) |
Single sign-on to all Azure AD-connected apps is supported. E.g. you can provide access to Office 365 or on-premises apps, and to other SaaS apps such as Salesforce or Workday. |
Single sign-on to customer owned apps within the Azure AD B2C tenants is supported. ❗ SSO to Office 365 or to other Microsoft and non-Microsoft SaaS apps is not supported. |
| Partner lifecycle |
Managed by the host/inviting organization. |
Self-serve or managed by the application. |
| Security policy and compliance |
Managed by the host/inviting organization. |
Managed by the application. |
| Branding |
Host/inviting organization’s brand is used. |
Managed by application. Typically tends to be product branded, with the organization fading into the background. |