Docs updates resulting from Azure AD B2C end of sale - p2

kengaderdus · kengaderdus · commit ef8b49705b2d · 2025-05-22T13:25:05.000+03:00
diff --git a/articles/api-management/api-management-features.md b/articles/api-management/api-management-features.md
@@ -52,7 +52,7 @@ Each API Management [pricing tier](api-management-key-concepts.md#api-management
 | Export API to Postman                                                         | Yes          | Yes       | Yes    | Yes       | Yes       | Yes       | Yes     | Yes |
 | Export API to MCP server (preview)                                                        | No          | No       | Yes    | No       | Yes       | No       | Yes     | No |
 
-<sup>1</sup> Enables the use of Microsoft Entra ID (and Azure AD B2C or Microsoft Entra External ID) as an identity provider for user sign in on the developer portal.<br/>
+<sup>1</sup> Enables the use of Microsoft Entra ID (and Azure AD B2C or [Microsoft Entra External ID](/entra/external-id/customers/overview-customers-ciam)) as an identity provider for user sign in on the developer portal.<br/>
 <sup>2</sup> Including related functionality such as users, groups, issues, applications, and email templates and notifications.<br/>
 <sup>3</sup> See [Gateway overview](api-management-gateways-overview.md#feature-comparison-managed-versus-self-hosted-gateways) for a feature comparison of managed versus self-hosted gateways. In the Developer tier, self-hosted gateways are limited to a single gateway node. <br/>
 <sup>4</sup> See [Gateway overview](api-management-gateways-overview.md#policies) for differences in policy support in the classic, v2, consumption, and self-hosted gateways. <br/>
diff --git a/articles/api-management/api-management-howto-developer-portal-customize.md b/articles/api-management/api-management-howto-developer-portal-customize.md
@@ -6,7 +6,7 @@ author: dlepow
 
 ms.service: azure-api-management
 ms.topic: tutorial
-ms.date: 04/28/2025
+ms.date: 05/28/2025
 ms.author: danlep
 ms.custom: engagement-fy23
 ---
@@ -220,5 +220,5 @@ Advance to the next tutorial:
 See related content about the developer portal:
 
 - [Azure API Management developer portal overview](developer-portal-overview.md)
-- Configure authentication to the developer portal with [usernames and passwords](developer-portal-basic-authentication.md), [Microsoft Entra ID](api-management-howto-aad.md), or [Azure AD B2C](api-management-howto-aad-b2c.md).
+- Configure authentication to the developer portal with [usernames and passwords](developer-portal-basic-authentication.md), [Microsoft Entra ID](api-management-howto-aad.md), or [Microsoft Entra External ID](/entra/external-id/customers/overview-customers-ciam).
 - Learn more about [customizing and extending](developer-portal-extend-custom-functionality.md) the functionality of the developer portal.
diff --git a/articles/api-management/api-management-howto-setup-delegation.md b/articles/api-management/api-management-howto-setup-delegation.md
@@ -6,7 +6,7 @@ services: api-management
 
 ms.service: azure-api-management
 ms.topic: how-to
-ms.date: 06/24/2024
+ms.date: 05/24/2025
 ms.author: danlep
 ---
 
@@ -200,7 +200,7 @@ var signature = digest.toString('base64');
 
 ## Related content
 - [Learn more about the developer portal.](api-management-howto-developer-portal.md)
-- [Authenticate using Microsoft Entra ID](api-management-howto-aad.md) or with [Azure AD B2C](api-management-howto-aad-b2c.md).
+- [Authenticate using Microsoft Entra ID](api-management-howto-aad.md) or with [Microsoft Entra External ID](/entra/external-id/customers/overview-customers-ciam).
 - More developer portal questions? [Find answers in our FAQ](developer-portal-faq.md).
 
 [Delegating developer sign-in and sign-up]: #delegate-signin-up
diff --git a/articles/api-management/developer-portal-basic-authentication.md b/articles/api-management/developer-portal-basic-authentication.md
@@ -19,7 +19,7 @@ In the developer portal for Azure API Management, the default authentication met
 For an overview of options to secure the developer portal, see [Secure access to the API Management developer portal](secure-developer-portal-access.md). 
 
 > [!CAUTION]
-> While you can use basic authentication to secure users' access to the developer portal, we recommend configuring a more secure authentication method such as [Microsoft Entra ID](api-management-howto-aad.md) or [Azure AD B2C](api-management-howto-aad-b2c.md), if available. 
+> While you can use basic authentication to secure users' access to the developer portal, we recommend configuring a more secure authentication method such as [Microsoft Entra ID](api-management-howto-aad.md) or [Microsoft Entra External ID](/entra/external-id/customers/overview-customers-ciam), if available. 
 
 ## Prerequisites
 
@@ -57,7 +57,7 @@ There are two ways to add a username and password for authentication to the deve
 
 ## Delete the username and password provider
 
-If you've configured another identity provider for the developer portal such as [Microsoft Entra ID](api-management-howto-aad.md) or [Azure AD B2C](api-management-howto-aad-b2c.md), you might want to delete the username and password provider. 
+If you've configured another identity provider for the developer portal such as [Microsoft Entra ID](api-management-howto-aad.md) or [Microsoft Entra External ID](/entra/external-id/customers/overview-customers-ciam), you might want to delete the username and password provider. 
 
 Deleting the identity provider prevents adding users to use username and password authentication. Existing users configured for basic authentication are also prevented from signing into the developer portal.
 
diff --git a/articles/api-management/developer-portal-faq.md b/articles/api-management/developer-portal-faq.md
@@ -7,7 +7,7 @@ author: dlepow
 
 ms.service: azure-api-management
 ms.topic: troubleshooting
-ms.date: 04/01/2024
+ms.date: 05/22/2025
 ms.author: danlep 
 ms.custom: devx-track-azurepowershell, devx-track-arm-template
 ---
@@ -57,7 +57,7 @@ After you update the domain, you need to [republish the portal](developer-portal
 
 ## I added an identity provider and I can't see it in the portal
 
-After you configure an identity provider (for example, Azure AD, Azure AD B2C), you need to [republish the portal](developer-portal-overview.md#publish-the-portal) for the changes to take effect. Make sure your developer portal pages include the OAuth buttons widget.
+After you configure an identity provider (for example, [Microsoft Entra ID](api-management-howto-aad.md) or [Microsoft Entra External ID](/entra/external-id/customers/overview-customers-ciam)), you need to [republish the portal](developer-portal-overview.md#publish-the-portal) for the changes to take effect. Make sure your developer portal pages include the OAuth buttons widget.
 
 ## I set up delegation and the portal doesn't use it
 
diff --git a/articles/api-management/developer-portal-overview.md b/articles/api-management/developer-portal-overview.md
@@ -180,7 +180,7 @@ The portal supports several options for user sign-up and sign-in:
 
 *  Basic authentication for developers to sign in with credentials for API Management [user accounts](api-management-howto-create-or-invite-developers.md).  Developers can sign up for an account directly through the portal, or you can create accounts for them.
 
-* Depending on your scenarios, restrict access to the portal by requiring users to sign up or sign in with a [Microsoft Entra ID](api-management-howto-aad.md) or [Azure AD B2C](api-management-howto-aad-b2c.md) account.
+* Depending on your scenarios, restrict access to the portal by requiring users to sign up or sign in with a [Microsoft Entra ID](api-management-howto-aad.md) or [Microsoft Entra External ID](/entra/external-id/customers/overview-customers-ciam) account.
 
 * If you already manage developer sign-up and sign-in through an existing website, [delegate authentication](api-management-howto-setup-delegation.md) instead of using the developer portal's built-in authentication.
 
diff --git a/articles/api-management/front-door-api-management.md b/articles/api-management/front-door-api-management.md
@@ -142,7 +142,7 @@ The following are high level steps to add an endpoint for the developer portal t
 For more information and details about settings, see [How to configure an origin for Azure Front Door](../frontdoor/how-to-configure-origin.md#create-a-new-origin-group).
 
 > [!NOTE]
-> If you've configured an [Microsoft Entra ID](api-management-howto-aad.md) or [Azure AD B2C](api-management-howto-aad-b2c.md) identity provider for the developer portal, you need to update the corresponding app registration with an additional redirect URL to Front Door. In the app registration, add the URL for the developer portal endpoint configured in your Front Door profile.
+> If you've configured an [Microsoft Entra ID](api-management-howto-aad.md) or [Microsoft Entra External ID](/entra/external-id/customers/overview-customers-ciam) identity provider for the developer portal, you need to update the corresponding app registration with an additional redirect URL to Front Door. In the app registration, add the URL for the developer portal endpoint configured in your Front Door profile.
 
 ## Related content
 
diff --git a/articles/api-management/secure-developer-portal-access.md b/articles/api-management/secure-developer-portal-access.md
@@ -39,7 +39,7 @@ API Management has a fully customizable, standalone, managed [developer portal](
 * **Basic authentication** - A default option is to use the built-in developer portal [username and password](developer-portal-basic-authentication.md) provider, which allows developers to register directly in API Management and sign in using API Management user accounts. User sign up through this option is protected by a CAPTCHA service. 
 
     > [!CAUTION]
-    > While you can use basic authentication to secure users' access to the developer portal, we recommend configuring a more secure authentication method such as [Microsoft Entra ID](api-management-howto-aad.md) or [Azure AD B2C](api-management-howto-aad-b2c.md).
+    > While you can use basic authentication to secure users' access to the developer portal, we recommend configuring a more secure authentication method such as [Microsoft Entra ID](api-management-howto-aad.md) or [Microsoft Entra External ID](/entra/external-id/customers/overview-customers-ciam).
 
 
 ## Developer portal test console
diff --git a/articles/api-management/validate-jwt-policy.md b/articles/api-management/validate-jwt-policy.md
@@ -206,6 +206,8 @@ The `validate-jwt` policy enforces existence and validity of a supported JSON we
 </validate-jwt>
 ```
 
+[!INCLUDE [active-directory-b2c-end-of-sale-notice-b](../../includes/active-directory-b2c-end-of-sale-notice-b.md)]
+
 ### Token validation using decryption key
 
 This example shows how to use the `validate-jwt` policy to validate a token that is decrypted using a decryption key. The key is specified using the ID of an uploaded certificate (in PFX format) that contains the public key.
diff --git a/articles/azure-government/compare-azure-government-global-azure.md b/articles/azure-government/compare-azure-government-global-azure.md
@@ -7,7 +7,7 @@ author: EliotSeattle
 ms.author: eliotgra
 ms.custom: references_regions
 recommendations: false
-ms.date: 07/12/2024
+ms.date: 05/22/2025
 ---
 
 # Compare Azure Government and global Azure
diff --git a/articles/azure-government/documentation-government-overview-wwps.md b/articles/azure-government/documentation-government-overview-wwps.md
@@ -6,7 +6,7 @@ ms.author: eliotgra
 ms.service: azure-government
 ms.topic: article
 recommendations: false
-ms.date: 01/21/2025
+ms.date: 05/21/2025
 ---
 
 # Azure for secure worldwide public sector cloud adoption
@@ -96,7 +96,7 @@ Microsoft Entra ID is a non-regional service that may store identity data global
 - Europe, where Microsoft Entra ID keeps most of the identity data within European datacenters except as noted in [Identity data storage for European customers in Microsoft Entra ID](../active-directory/fundamentals/active-directory-data-storage-eu.md).
 - Australia and New Zealand, where identity data is stored in Australia except as noted in [Customer data storage for Australian and New Zealand customers in Microsoft Entra ID](../active-directory/fundamentals/active-directory-data-storage-australia-newzealand.md).
 
-Microsoft Entra ID provides a [dashboard](https://go.microsoft.com/fwlink/?linkid=2092972) with transparent insight into data location for every Microsoft Entra component service. Among other features, Microsoft Entra ID is an identity management service that stores directory data for your Azure administrators, including user **personal data** categorized as **End User Identifiable Information (EUII)**, for example, names, email addresses, and so on. In Microsoft Entra ID, you can create User, Group, Device, Application, and other entities using various attribute types such as Integer, DateTime, Binary, String (limited to 256 characters), and so on. Microsoft Entra ID isn't intended to store your customer content and it isn't possible to store blobs, files, database records, and similar structures in Microsoft Entra ID. Moreover, Microsoft Entra ID isn't intended to be an identity management service for your external end users – [Azure AD B2C](../active-directory-b2c/overview.md) should be used for that purpose.
+Microsoft Entra ID provides a [dashboard](https://go.microsoft.com/fwlink/?linkid=2092972) with transparent insight into data location for every Microsoft Entra component service. Among other features, Microsoft Entra ID is an identity management service that stores directory data for your Azure administrators, including user **personal data** categorized as **End User Identifiable Information (EUII)**, for example, names, email addresses, and so on. In Microsoft Entra ID, you can create User, Group, Device, Application, and other entities using various attribute types such as Integer, DateTime, Binary, String (limited to 256 characters), and so on. Microsoft Entra ID isn't intended to store your customer content and it isn't possible to store blobs, files, database records, and similar structures in Microsoft Entra ID. Moreover, Microsoft Entra ID isn't intended to be an identity management service for your external end users – [Microsoft Entra External ID](/entra/external-id/customers/overview-customers-ciam) should be used for that purpose.
 
 Microsoft Entra ID implements extensive **data protection features**, including tenant isolation and access control, data encryption in transit, secrets encryption and management, disk level encryption, advanced cryptographic algorithms used by various Microsoft Entra components, data operational considerations for insider access, and more. Detailed information is available from a whitepaper [Active Directory Data Security Considerations](https://aka.ms/AADDataWhitePaper).
 
diff --git a/articles/devtest/offer/concepts-security-governance-devtest.md b/articles/devtest/offer/concepts-security-governance-devtest.md
@@ -6,7 +6,7 @@ author: rigel512
 ms.service: visual-studio-family
 ms.subservice: subscriptions
 ms.topic: how-to 
-ms.date: 10/18/2023
+ms.date: 05/24/2025
 ms.custom: devtestoffer
 ---
 
@@ -56,7 +56,7 @@ This security barrier has two components:
 
 [A tenant](../../active-directory/develop/quickstart-create-new-tenant.md) is a dedicated instance of Microsoft Entra ID that an organization or app developer receives when the organization or app developer creates a relationship with Microsoft like signing up for Azure, Microsoft Intune, or Microsoft 365.  
 
-Each Microsoft Entra tenant is separate from other Microsoft Entra tenants. Each Microsoft Entra tenant has its own representation of work and school identities, consumer identities (if it's an Azure AD B2C tenant), and app registrations. An app registration inside your tenant can allow authentications from accounts only within your tenant or all tenants.  
+Each Microsoft Entra tenant is separate from other Microsoft Entra tenants. Each Microsoft Entra tenant has its own representation of work and school identities, consumer identities (if it's an external tenant), and app registrations. An app registration inside your tenant can allow authentications from accounts only within your tenant or all tenants.  
 
 If you need to further separate your organization’s identity infrastructure beyond management groups within a single tenant, you can also create another tenants with its own resource hierarchy.  
 
diff --git a/articles/healthcare-apis/authentication-authorization.md b/articles/healthcare-apis/authentication-authorization.md
@@ -5,7 +5,7 @@ services: healthcare-apis
 author: EXPEkesheth
 ms.service: azure-health-data-services
 ms.topic: overview
-ms.date: 04/30/2024
+ms.date: 05/24/2025
 ms.author: kesheth
 ---
 
diff --git a/articles/healthcare-apis/fhir/fhir-faq.md b/articles/healthcare-apis/fhir/fhir-faq.md
@@ -6,7 +6,7 @@ author: expekesheth
 ms.service: azure-health-data-services
 ms.subservice: fhir
 ms.topic: reference
-ms.date: 09/27/2023
+ms.date: 05/27/2025
 ms.author: kesheth
 ms.custom: references_regions
 ---
@@ -37,7 +37,7 @@ We support Microsoft Entra ID and third party identity provider that support Ope
 
 ### Can I use Azure AD B2C with the FHIR service?
 
-Yes. You can use [Azure Active Directory B2C](../../active-directory-b2c/overview.md) (Azure AD B2C) with the FHIR service to grant access to your applications and users. For more information, see [Use Azure Active Directory B2C to grant access to the FHIR service](../fhir/azure-ad-b2c-setup.md).
+Yes. You can use [Azure Active Directory B2C](../../active-directory-b2c/overview.md) (Azure AD B2C) with the FHIR service to grant access to your applications and users. For more information, see [Use Azure Active Directory B2C to grant access to the FHIR service](../fhir/azure-ad-b2c-setup.md). However, effective **May 1, 2025**, Azure AD B2C will no longer be available to purchase for new customers. New customers need to use [Microsoft Entra External ID](/entra/external-id/customers/overview-customers-ciam).
 
 ### What FHIR version do you support?
 
diff --git a/articles/healthcare-apis/health-data-services-get-started.md b/articles/healthcare-apis/health-data-services-get-started.md
@@ -5,7 +5,7 @@ author: EXPEkesheth
 ms.service: azure-health-data-services
 ms.subservice: fhir
 ms.topic: conceptual
-ms.date: 06/10/2024
+ms.date: 05/24/2025
 ms.author: kesheth
 ---
 
diff --git a/articles/role-based-access-control/permissions/identity.md b/articles/role-based-access-control/permissions/identity.md
@@ -6,7 +6,7 @@ ms.topic: generated-reference
 author: rolyon
 manager: femila
 ms.author: rolyon
-ms.date: 04/25/2025
+ms.date: 05/25/2025
 ms.custom: generated
 ---
 
diff --git a/articles/role-based-access-control/resource-provider-operations.md b/articles/role-based-access-control/resource-provider-operations.md
@@ -7,7 +7,7 @@ ms.workload: identity
 author: rolyon
 manager: femila
 ms.author: rolyon
-ms.date: 04/25/2025
+ms.date: 05/25/2025
 ms.custom: generated
 ---
 
diff --git a/articles/security/develop/secure-design.md b/articles/security/develop/secure-design.md
@@ -4,7 +4,7 @@ description: This article discusses best practices to consider during the requir
 author: msmbaldwin
 manager: rkarlin
 ms.author: mbaldwin
-ms.date: 09/29/2024
+ms.date: 05/28/2025
 ms.topic: article
 ms.service: security
 ms.subservice: security-develop
@@ -242,7 +242,7 @@ Use platform-supplied authentication and authorization mechanisms instead of cus
 
 * [Microsoft identity platform](../../active-directory/develop/index.yml) is a set of components that developers use to build apps that securely sign in users. The platform assists developers who are building single-tenant, line-of-business (LOB) apps and developers who are looking to develop multitenant apps. In addition to basic sign-in, apps built by using the Microsoft identity platform can call Microsoft APIs and custom APIs. The Microsoft identity platform supports industry-standard protocols like OAuth 2.0 and OpenID Connect.
 
-* [Azure Active Directory B2C](../../active-directory-b2c/index.yml) (Azure AD B2C) is an identity management service you use to customize and control how customers sign up, sign in, and manage their profiles when they use your applications. This includes applications that are developed for iOS, Android, and .NET, among others. Azure AD B2C enables these actions while protecting customer identities.
+* [Microsoft Entra External ID in external tenants](/entra/external-id/customers/overview-customers-ciam) is an identity management service you use to customize and control how customers sign up, sign in, and manage their profiles when they use your applications. This includes applications that are developed for iOS, Android, and .NET, among others. Azure AD B2C enables these actions while protecting customer identities.
 
 #### Apply the principle of least privilege
 
diff --git a/articles/security/develop/secure-develop.md b/articles/security/develop/secure-develop.md
@@ -4,7 +4,7 @@ description: This article discusses best practices to consider during the implem
 author: msmbaldwin
 manager: rkarlin
 ms.author: mbaldwin
-ms.date: 09/29/2024
+ms.date: 05/28/2025
 ms.topic: article
 ms.service: security
 ms.subservice: security-develop
@@ -83,8 +83,8 @@ This means fewer people have access to your real data, which reduces your attack
 
 To defend against brute-force and dictionary-based guessing, you must implement a strong password policy to ensure that users create a complex password (for example, 12 characters minimum length and requiring alphanumeric and special characters).
 
-Azure Active Directory B2C helps you with password management, by providing
-[self-service password reset](../../active-directory-b2c/add-password-reset-policy.md), [force password reset](../../active-directory-b2c/force-password-reset.md), and more.
+Microsoft Entra External ID in external tenants help you with password management, by providing
+[self-service password reset](/entra/external-id/customers/how-to-enable-password-reset-customers) and more.
 
 To defend against attacks on default accounts, verify that all keys and passwords are replaceable and that they're generated or replaced after you install resources.
 
diff --git a/articles/security/fundamentals/end-to-end.md b/articles/security/fundamentals/end-to-end.md
