Entra ID Identity

External Identities and Conditional Access — identity providers, named locations, conditional access policies, and self-service sign-up user flows.

---

Prerequisites

Permission	Description	Reference
IdentityProvider.Read.All	Read identity providers and supported types	IdentityProvider permissions
Policy.Read.All	Read conditional access policies and named locations	Policy permissions
IdentityUserFlow.Read.All	Read self-service sign-up user flows	UserFlow permissions

---

How the identity pieces fit together

graph TD
    subgraph External Identities
        IP["Identity providers<br/>(SAML, social, OIDC)"]
        UF["Self-service sign-up<br/>user flows (B2X)"]
    end

    subgraph Conditional Access
        NL["Named locations<br/>(IP ranges, countries)"]
        CA["Conditional access<br/>policies"]
    end

    IP --> UF
    NL --> CA

Which endpoint to use: identity.identity_providers for the federated identity providers a tenant trusts, identity.conditional_access.named_locations for trusted network locations, identity.conditional_access.policies for the access rules, and identity.b2x_user_flows for self-service sign-up experiences.

---

Examples

Operation	File	Permission	API
List identity providers	list_provider.py	IdentityProvider.Read.All	identityProviderBase list
List named locations	list_named_locations.py	Policy.Read.All	namedLocation list
List conditional access policies	list_conditional_access_policies.py	Policy.Read.All	conditionalAccessPolicy list
List self-service sign-up user flows	list_user_flows.py	IdentityUserFlow.Read.All	b2xUserFlows list

---

API reference

• IdentityProviderBase resource
• NamedLocation resource
• ConditionalAccessPolicy resource
• B2XIdentityUserFlow resource