Skip to content
Seamless Auth Docs

Seamless Auth vs Microsoft Entra ID

Microsoft Entra ID is Microsoft’s cloud identity and access management service. Most readers meet it as the directory behind Microsoft 365: employees sign in to Microsoft and third-party apps, admins set Conditional Access policy, and on-premises Active Directory syncs into it. Microsoft sells a second configuration, Entra External ID, for customer-facing apps. Seamless Auth is an open source (Apache-2.0), passwordless-only auth server that you self-host or run on the Seamless Auth managed service. Today it signs users in to applications you build, and, through its optional OpenID Provider, to other apps that speak OpenID Connect.

The two overlap less than the word “identity” suggests. Entra ID is a workforce directory with governance, device and network access around it. Seamless Auth has none of that yet: a SAML identity provider, directory sync, and joiner, mover and leaver lifecycle are planned for Seamless Auth v2.0 and are not shipped. This page compares the two as equals only where both have the feature today, and says so where Seamless Auth does not.

Every Entra detail links to Microsoft’s own docs or pricing pages, and the Sources section gives the date each one was checked. Seamless Auth details were checked against the docs and source repositories at Seamless Auth API v0.22.0 and OpenID Provider v0.3.0 on 2026-11-07. Microsoft changes plans and prices, so confirm them on Microsoft’s Entra pricing page before you decide.

Choose Entra ID If

Section titled “Choose Entra ID If”
  • You need a workforce directory and you already run Microsoft 365. Entra ID P1 is included in Microsoft 365 E3, E5 and E7 and in Business Premium, and P2 in E5 and E7. If you already pay for it, Seamless Auth does not replace anything you would stop paying for. Seamless Auth has no employee directory, group-based app assignment, or app launcher (planned for v2.0).
  • You need SAML single sign-on into third-party apps. Entra ID signs users in to cloud apps with SAML 2.0, OpenID Connect, OAuth, password-based SSO (password vaulting) or linked SSO, and its app gallery holds thousands of preintegrated apps. Seamless Auth’s OpenID Provider signs users in to apps that speak OpenID Connect; it has no SAML identity provider (planned for v2.0).
  • You need provisioning and lifecycle. Entra provisions users into apps over SCIM and other connectors, takes HR data from Workday or SuccessFactors or any system of record through an API, and syncs from on-premises Active Directory with Cloud Sync or Connect Sync. Lifecycle Workflows (Entra ID Governance) automate joiner, mover and leaver tasks. Seamless Auth has no SCIM, no directory sync and no lifecycle automation (SCIM server planned for v1.2, the rest for v2.0).
  • You need policy beyond sign-in. Conditional Access (P1) and risk-based Conditional Access, ID Protection and Privileged Identity Management (P2) have no Seamless Auth equivalent. Seamless Auth has sign-in policy settings, such as phishing_resistant_only, and step-up for sensitive actions, not a policy engine over users, devices, locations and risk.
  • You need Windows, device or network access. Windows Hello for Business, Platform Credential for macOS, Entra Domain Services (managed LDAP and Kerberos), Application Proxy and Private Access are outside what Seamless Auth does. RADIUS, LDAP and forward-auth are planned for v2.1.
  • You need government or regulated-cloud authorization. Microsoft lists Entra ID Free and P1/P2 at FedRAMP High and DoD IL2 in Azure public, up to IL6 in Azure Government, and states a 99.99% authentication availability commitment. Seamless Auth has no third-party attestations of its own.
  • You want passwords available. Entra supports passwords. Seamless Auth has no password flow, by design.

Choose Seamless Auth If

Section titled “Choose Seamless Auth If”
  • Users and sessions must stay inside your own boundary. Self-hosted, the auth API and its Postgres database run in your infrastructure, on any cloud or none. Microsoft describes Entra ID as “a cloud-based identity and access management service”; its on-premises pieces (Cloud Sync and Connect Sync agents, the private network connector) connect to that cloud service.
  • You want the auth server’s source under a permissive license. The auth API, OpenID Provider, server adapters, frontend SDKs, admin dashboard and CLI are all Apache-2.0. Entra is a commercial service.
  • You are building a customer-facing app and want passkeys as the default, enforced. In an Entra External ID tenant, Microsoft’s passkey docs say only email and username accounts with a password can register a passkey, that apps build the registration step themselves, that passkeys need a custom URL domain (served through Azure Front Door, a separately billed Azure service), and that external tenants cannot require passkeys through Conditional Access. In Seamless Auth, passkeys are the primary sign-in method, registration is built in, and phishing_resistant_only accepts only passkeys to start a session.
  • You want no password to exist at all. Seamless Auth has no password column. For Entra ID, Microsoft’s guidance on going passwordless is to set passwords to a random value (“password scrambling”) and turn off password reset and writeback, not to remove them.
  • You prefer not to pay per user or per active user. Self-hosting has no per-user fee; you pay for the infrastructure you run. Entra workforce plans are priced per user per month, and External ID per monthly active user after a free allowance, with SMS billed per attempt. The Identity Cost Calculator covers several providers’ published prices next to the cost of self-hosting.
  • You want your user data and audit trail in a database you can query. Self-hosted, users, memberships and auth events are rows in your own Postgres, and the auth event trail exports as a hash-chained NDJSON file you can verify. Entra keeps audit and sign-in logs for 7 days on Free and 30 days on P1 and P2, and longer retention means routing them through Azure Monitor.
  • Your app needs sign-in, not a directory. If what you need is passkey sign-in, recovery, and sessions for an app your team builds, an adapter for Node.js, Go, Python or Rust and a frontend SDK is a shorter path than an Entra tenant, app registrations and MSAL.

Feature Comparison: Workforce

Section titled “Feature Comparison: Workforce”

Entra column as checked on the dates in Sources. “P1”, “P2” and “ID Governance” are Microsoft’s license names. Where the Seamless Auth column says Planned, the feature does not exist today.

Seamless Auth Microsoft Entra ID
License Apache-2.0 for the server, OpenID Provider, SDKs, dashboard and CLI Commercial cloud service, licensed per user
Hosting Self-host (Docker, Postgres) or Seamless Auth managed hosting Microsoft-operated cloud; separate national clouds for US Government and 21Vianet (China)
Passkeys Yes, the primary sign-in method (WebAuthn via SimpleWebAuthn) Yes: device-bound and synced passkeys (FIDO2), passkeys in Microsoft Authenticator
Other sign-in methods Magic link, email OTP, SMS OTP (Twilio or AWS SNS, configured by you) Password, Windows Hello for Business, Platform Credential for macOS, certificate-based auth, Authenticator passwordless, QR code, SMS sign-in, Temporary Access Pass
Phishing-resistant only Yes, phishing_resistant_only accepts only passkeys to start a session Conditional Access (P1) can require the built-in phishing-resistant MFA strength for a resource; Microsoft notes a strength does not restrict the initial authentication
MFA and step-up TOTP and passkey (WebAuthn) step-up Authenticator push, software OATH tokens, hardware OATH tokens (preview), SMS, voice, passkeys, external MFA
Passwords No, by design Yes; Microsoft’s passwordless guidance scrambles them rather than removing them
Account recovery Recovery codes, self-service account recovery, break-glass admins (v0.20) Self-service password reset; Verified ID for account recovery
SSO into third-party apps OpenID Connect only, through the OpenID Provider (v0.21, off by default, not OpenID certified); tested guides for Grafana, Auth.js, Spring Security and oauth2-proxy SAML 2.0, OpenID Connect, OAuth, password-based and linked SSO; app gallery with thousands of apps; a WS-Federation endpoint
SAML identity provider Planned for v2.0 Yes
Directory and groups, app assignment, app launcher Planned for v2.0. Users, global roles and organizations exist today Yes
Sync from Active Directory or another directory Planned for v2.0 (Google Workspace and Entra ID) Cloud Sync and Connect Sync from on-premises AD
Provisioning to apps (outbound SCIM) Planned for v2.0 Yes, SCIM and other connectors; SaaS user provisioning on Free, group provisioning and on-premises apps on P1
Inbound provisioning CSV import and seamless migrate; SCIM server planned for v1.2 HR-driven (Workday, SuccessFactors) and API-driven inbound provisioning on P1 and P2
Lifecycle automation Planned for v2.0 Lifecycle Workflows, with an ID Governance license
Policy Instance sign-in settings, staged sign-in policy, step-up Conditional Access (P1); ID Protection and risk-based Conditional Access (P2)
Privileged access Break-glass admins, admin step-up Privileged Identity Management (P2 or ID Governance)
Roles and permissions in the token Organization membership roles today. A permission catalogue, role-to-permission mapping and organization roles in the token need API v0.23.0, which is not released App roles and scopes in access tokens (roles, scp)
Tokens for your own APIs Yes, through the OpenID Provider: authorization code with S256 PKCE, client credentials, device grant (first-party), RFC 9068 JWT access tokens Yes: expose an API with scopes, client credentials with a secret, certificate or federated credential
Extensibility Logic in your own backend, behind the server adapter. Webhooks and login hooks are planned for v0.23 Custom authentication extensions (REST calls on token issuance and other events), custom security attributes
Audit trail Append-only, hash-chained auth events; NDJSON export with an integrity check Audit and sign-in logs: 7 days on Free, 30 days on P1 and P2; export through Azure Monitor to Log Analytics, Event Hubs or storage
User export No bulk export endpoint; self-hosted, the data is in your own Postgres. Paginated admin user list and a passkey coverage report (CSV) Microsoft Graph, and a CSV download of profile properties in the portal (preview). Microsoft documents no password hash export
Third-party compliance attestations None for Seamless Auth itself FedRAMP High and DoD IL2 (Azure public), up to IL6 (Azure Government)
Availability commitment Yours, when self-hosted Microsoft states 99.99% availability for authentication
Maturity 0.x, small community Established commercial service, very large installed base
Pricing model Free to self-host; managed plans in the portal Free tier, then per user per month for P1, P2, ID Governance and Entra Suite

Entra External ID

Section titled “Entra External ID”

Entra External ID is Microsoft’s customer identity product: you create an external tenant, which follows the Entra tenant model but is configured for consumer and business-customer apps. Microsoft says Azure AD B2C is no longer sold to new customers as of May 1, 2025, and that new customer identity features are built on External ID. This is the part of Entra that competes most directly with what Seamless Auth does today.

Seamless Auth Entra External ID
Hosting Self-host or Seamless Auth managed hosting External tenant on Microsoft’s cloud; data residency add-on (Go-Local) in Australia and Japan
Primary sign-in Passkeys, magic link, email OTP, SMS OTP Email with password (the default) or email one-time passcode; username sign-in in preview
Passkeys Primary method; built-in registration; can be the only method For email and username accounts with a password, after MFA; app builds registration with the credential management API; needs a custom URL domain; cannot be required by policy
SMS Sign-in code, through your own Twilio or AWS SNS account Paid add-on, billed per attempt; MFA and password reset only, not a first factor
Social and federated login Instance-wide OpenID Connect providers; CLI presets for Google, GitHub, Microsoft (Entra ID), GitLab Google, Facebook, Apple, an Entra ID tenant, custom OIDC, and SAML or WS-Fed providers
MFA TOTP and passkey step-up Email OTP, SMS (add-on), TOTP, passkeys; enforced with Conditional Access
Sign-in UI Built-in auth routes in your app (React, Angular, Vue, Svelte), headless, or the OpenID Provider’s hosted pages Hosted user flows with branding; native authentication through MSAL for Android, iOS, macOS and web (local accounts only)
Custom domain Your own domain, always Custom URL domains through a reverse proxy such as Azure Front Door, billed separately
Hooks Your own backend Custom authentication extensions on token issuance, attribute collection and OTP send
Machine-to-machine Client credentials through the OpenID Provider M2M Premium add-on
Log retention Your own Postgres, as long as you keep it 7 days on the Basic plan
Pricing model Free to self-host; managed plans in the portal Free for the first 50,000 MAU, then $0.03 per MAU; SMS, M2M and Go-Local are paid add-ons; admins in an external tenant count toward MAU

Architecture Difference

Section titled “Architecture Difference”

Entra ID is a central identity provider for an organization. Apps are registered in the tenant and redirect users to login.microsoftonline.com (or, for External ID, <tenant>.ciamlogin.com or a custom URL domain). Entra evaluates Conditional Access, authenticates the user, and returns SAML assertions or OpenID Connect tokens. Users, groups, devices and app assignments live in the tenant, and you manage them through the admin center or Microsoft Graph.

Seamless Auth is a service you run next to your backend:

browser or native app
  -> your backend's /auth routes   (@seamless-auth/express, fastify, nextjs, or the Python/Go/Rust adapter)
  -> seamless-auth-api             (your infrastructure, or Seamless Auth managed)
  -> Postgres

Clients never call the auth API directly. Your backend mounts the adapter routes, forwards calls with a service token, and keeps the session in signed httpOnly cookies on your domain (native apps use bearer tokens in the platform keystore). Authorization stays in your own code. See What Is Seamless Auth?.

Since v0.21 you can also run the optional OpenID Provider, a separate public service in front of the private API. Apps that speak OpenID Connect, such as Grafana or an internal tool behind oauth2-proxy, redirect to its hosted pages and get tokens back the way they would from Entra, with no Seamless SDK. That covers some internal-app sign-in today. It is not a workforce directory: there is no SAML, no group-based app assignment, and no provisioning.

The two also work together. Seamless Auth can use Entra ID as an upstream OpenID Connect provider (OAuth Login), so employees sign in with their Entra account while your app gets a Seamless session.

When Not To Use Seamless Auth

Section titled “When Not To Use Seamless Auth”

If any of these is a hard requirement today, stay on Entra ID or choose another product.

  • You need to sign employees in to SAML apps, or to Microsoft 365. Seamless Auth has no SAML identity provider (planned for v2.0) and is not a Microsoft 365 identity source.
  • You provision or deprovision accounts from HR or a directory. There is no SCIM, no directory sync and no lifecycle automation. Bulk changes go through the CSV import.
  • You rely on Conditional Access, risk policies or PIM. Seamless Auth has no equivalent.
  • You need Windows sign-in, device trust, LDAP or Kerberos. Out of scope today; RADIUS, LDAP and forward-auth are planned for v2.1.
  • You need permissions in the token now. That needs API v0.23.0, which is not released.
  • Other apps need a certified identity provider. The OpenID Provider is new and not OpenID certified.
  • You need a vendor’s FedRAMP authorization or a contractual SLA for the auth service itself. Seamless Auth has no third-party attestations. Self-hosted, it is covered by your own controls.
  • Your users sign in with passwords and you cannot change that. There is no password flow, and no password hashes are imported.
  • You need a 1.0 stability guarantee. Every Seamless Auth package is still 0.x.

The full list is in When Seamless Auth Is Not The Right Choice.

Migrating From Entra ID

Section titled “Migrating From Entra ID”

For an app whose users live in Entra ID, seamless migrate entra-id reads the directory through Microsoft Graph and imports identities (mail as the email, mobilePhone as the phone, the object id as the external id, and optionally group membership as organizations and roles), as a dry run unless you pass --apply. Run seamless migrate assess entra-id first for a readiness report. See Migrate Users From Another Identity System and migrate entra-id.

No credentials move. During cutover, imported users can keep signing in with their Entra account through OpenID Connect, then enroll a passkey (sign in through the old provider). This moves an app’s users, not an organization’s workforce identity: Entra ID stays the directory for everything else.

Sources

Section titled “Sources”

Microsoft Entra details, each checked on 2026-11-07 on Microsoft’s own pages:

Not verified, so not claimed on this page: the contractual SLA terms in Microsoft’s Online Services SLA, Entra ID’s specific SOC and ISO audit scope, and whether External ID passkeys are generally available (the page carries no preview label and no GA statement).

Seamless Auth details (Seamless Auth API v0.22.0, OpenID Provider v0.3.0, checked 2026-11-07):

Part of the Fells Code family
Seamless AuthSeamless SecretsReview BoardSeamless CLISeamless Glance