Microsoft Entra ID · B2C & External Identity
External ID User Flow Administrator
Creates and manages all aspects of user flows for external identity scenarios.
Scope: Full management of user flows for B2C and External ID
Permissions
- Create user flows
- Update user flows
- Delete user flows
- Manage user flow configuration
Common use cases
- Configuring sign-up/sign-in flows
- Customizing user journeys
- Managing self-service registration
Best practices
- Test flows thoroughly
- Version control configurations
- Monitor flow analytics
Security considerations
- Controls how external users register
- Affects authentication experience
Common questions
When should I assign the External ID User Flow Administrator role?
Assign External ID User Flow Administrator when you need to: Configuring sign-up/sign-in flows; Customizing user journeys; and Managing self-service registration. It is part of Microsoft Entra ID and should be granted as a least-privilege alternative to broader roles like Global Administrator.
What can someone with the External ID User Flow Administrator role do?
The External ID User Flow Administrator role grants permissions including: Create user flows; Update user flows; Delete user flows; and Manage user flow configuration. See the Permissions section above for the full list.
What are the security risks of the External ID User Flow Administrator role?
Key considerations when assigning External ID User Flow Administrator: Controls how external users register; and Affects authentication experience. Review the Security considerations section before assignment, and pair with Privileged Identity Management (PIM) for just-in-time access where possible.