I’m considering Entra External ID for a small SaaS. I’m familiar with Cognito, Supabase, and ASP.NET Core Identity, but the External ID setup feels less straightforward, especially around Terraform support, user flows, and tenant boundaries.
Is it worth working through the learning curve, or would another provider be a better fit if I want to spend less time configuring authentication?
It can be workable, but whether it fits depends on how much setup and ongoing configuration you’re willing to own. Being happy with other Azure services doesn’t necessarily mean you need to use its identity product too.
Pick one representative task, such as setting up the sign-in options you need, and try to get it working end to end. Include a check of what you can configure with Terraform and what still needs manual work. If that takes more time than you can justify, Cognito or Supabase may be a more comfortable choice given your existing experience.
You can use a separate tenant or directory for your SaaS users rather than the one associated with your Azure resources. That gives you a clearer boundary to work with.
I’d still verify the actual access assignments and configuration rather than assuming the separate directory answers every security question. If the interfaces and guidance are confusing, test the setup carefully before relying on it.
Be careful using an AI assistant as the authority on the setup. It can mix up External ID, older Azure AD B2C guidance, and internal Entra settings, or point you to options that aren’t present in your tenant.
Check the current Microsoft documentation for the specific tenant type and feature you’re configuring. If you get stuck, narrow it down to one concrete issue, like enabling personal Microsoft account sign-in, and check that separately rather than following a long generated walkthrough.
Virel.83:
That also makes it easier to tell whether the problem is a missing feature, a documentation mismatch, or just a setting in a different place.
There are other options worth comparing beyond Cognito and Supabase. Auth0 is an option if automation and documentation are high priorities. Keycloak is another possible choice, though its documentation may not always be straightforward either.
I’d compare them against the sign-in methods and automation you actually need before committing, rather than choosing solely because the rest of the app is on Azure.
Answers are reviewed before publication.
6c.Rivet_51:
That makes sense. The manual configuration is part of what worries me, since it’s harder to tell whether I’ve missed something.