Microsoft Entra ID vs. Duende IdentityServer
Microsoft Entra ID is a managed cloud directory for workforce identity, covering Microsoft 365 SSO, Conditional Access, and device policies. Duende IdentityServer is a self-hosted token server for application and customer identity, giving you your own clients, claims, and login experience running in your infrastructure. Many organizations use both: Duende IdentityServer as the token server their applications integrate with, and Entra ID federated behind it as the upstream workforce identity provider.
Microsoft Entra ID (formerly Azure AD) is a managed cloud directory and token service. It is the backbone of Microsoft 365 identity and a strong choice for workforce identity: employees, corporate SSO, Conditional Access, device compliance, and deep integration with the Microsoft ecosystem.
Duende IdentityServer is an identity server you host in your own ASP.NET Core identity host, a dedicated host that is separate from the applications it secures. It is built for application and customer identity: issuing tokens for your own APIs and apps, with full control over clients, claims, and the user experience, and with your data in your own infrastructure.
The two are often complementary rather than either/or.
This comparison was made on August 24, 2026. Both products are actively developed and their functionality changes regularly, so the comparison may not be fully accurate at the time of reading.
How Do Microsoft Entra ID and Duende IdentityServer Compare?
Because the two products target different problems, this matrix compares scope and delivery model more than protocol checkboxes:
| Capability / Aspect | Microsoft Entra ID | Duende IdentityServer |
|---|---|---|
| Primary role | Corporate directory and workforce SSO | Application and customer token server |
| Operating model | Managed SaaS | Self-hosted in an ASP.NET Core identity host you own |
| App model | App registrations, service principals | |
| Login UI | Microsoft-hosted (some branding options) | You build it (full control) |
| Token / claims customization | Claims-mapping policies (platform-constrained) | |
| Conditional Access / device compliance | Native (P1/P2) | Out of scope, a different product category; combine via federation |
| Microsoft 365 SSO | Native | Via federation with Entra as upstream provider |
| Directory / Graph API | Microsoft Graph | Your user store / User Management |
| MFA / passwordless | Authenticator, FIDO2 keys, phone | User Management (passkeys, TOTP, OTP) |
| Customer identity (CIAM) | Entra External ID / Azure AD B2C | Your login pages + User Management |
| SAML 2.0 | Native | SAML 2.0 add-on (included in Advanced; add-on for Standard) |
| Server-side sessions | Platform-managed | Native support (included in Standard and Advanced) |
| OpenTelemetry observability | Platform sign-in logs / Azure Monitor | Native support (metrics, traces, and logs) |
| Signing key management | Managed by the platform | Automated, rolling zero-downtime key rotation (Standard and Advanced) |
| Data residency | Microsoft cloud (region options) | Your infrastructure |
| Pricing model | Per user (Free / P1 / P2; External ID per MAU) | Licensing tiers based on functionality and client IDs; commercial license (free for dev/test; Community Edition for qualifying organizations) |
In addition to feature comparisons, the following map helps you align Entra ID’s directory-centric concepts with Duende IdentityServer’s application-focused architecture.
How Do Microsoft Entra ID Concepts Map to Duende IdentityServer?
| Microsoft Entra ID | Duende IdentityServer | Notes |
|---|---|---|
| Tenant | Your issuer / identity host |
|
| App registration |
| |
| Enterprise application (service principal) | Client configuration | The installed side of an app registration |
| Exposed API scopes (api://...) |
| |
| Delegated permissions | | On-behalf-of-a-user access |
| Application permissions | | App-only access |
| App roles | |
|
| Groups | Claims via IProfileService |
|
| Conditional Access policies | Auth pipeline + claims logic (or federate Entra upstream) | Different product category |
| Microsoft Graph API | Your user store / User Management | No equivalent of a directory API; you own the data layer |
| Managed Identities / Workload Identity Federation | | Machine-to-machine auth via standard grant type |
| Token Exchange (OBO flow) | Token exchange (RFC 8693) (Standard and Advanced) | Standards-based equivalent |
| Continuous Access Evaluation (CAE) | Short-lived tokens + server-side sessions; revoke via back-channel logout | Same security outcome, different mechanism |
| Identity Protection (risk detections) | Not a core feature; implement risk scoring externally | Different product category |
| Azure AD B2C user flows / policies | Your login UI + ASP.NET Core pipeline + User Management | Custom flows in code, not policy XML |
When Is Microsoft Entra ID the Right Fit for You?
Entra ID is the right tool for workforce identity and anything that needs to ride on the Microsoft platform: Microsoft 365 SSO, Conditional Access, device-based policies, and directory data through Microsoft Graph. Those capabilities belong to the identity-and-endpoint-management category, and Duende IdentityServer doesn’t try to replace them. That is a difference in scope, not a gap.
Duende IdentityServer is the right tool when you want to own application and customer identity: issue tokens for your own APIs, model your own clients and scopes, shape claims in C#, and keep user data in your own systems. For customer-facing identity in particular, running your own token server avoids per-user directory costs and platform constraints.
Because the two overlap so little in intent, federation is often the best answer. Add Entra ID as an upstream identity provider to your Duende identity host: your applications integrate with one issuer (Duende), while employees still authenticate through Entra. This is a valid long-term architecture, not just a migration stepping stone, and it gives you application-owned tokens and corporate SSO. On multi-factor specifically, Duende User Management provides passkeys and FIDO2, TOTP, and OTP for the users you own.
Customer Identity: Entra External ID and Azure AD B2C
Everything above is about workforce identity. Entra ID’s customer-facing (CIAM) story is a separate product: Microsoft Entra External ID, the successor to Azure AD B2C. B2C still runs for existing tenants, but new consumer and customer scenarios are directed to External ID. Both give you hosted sign-up and sign-in, social logins, and configurable user flows for consumer-facing apps.
This is the Entra scenario that overlaps most with Duende IdentityServer, because customer identity is exactly what Duende is built for. Instead of hosted user flows, you build the sign-up, sign-in, and profile pages as ASP.NET Core pages and back them with User Management (passkeys, TOTP, OTP, recovery codes, and self-service) or your own store. You trade the convenience of prebuilt flows for full control over the customer experience, and your user data stays in your own infrastructure rather than a Microsoft tenant. If you already run B2C or External ID and want to move, the work is the same as the rest of this guide: rebuild the user-flow UI, map app registrations to clients, and bring users across (Entra does not export password hashes, so federate first or reset on first sign-in).
How Do You Migrate to Duende IdentityServer?
Entra ID does not export password hashes, so federate-first is the natural path: stand up your Duende identity host, add Entra as an upstream provider, migrate applications one at a time, and decide later whether to keep federation permanently. See the migration approaches post.