Enterprise Identity & Access Management Platform · View 19 of 27 · Runtime

External Identity

A customer signing in, a partner employee reaching a corporate resource, and the line between them.

Editable source SVG draw.io All views

The red line is the point of the view. The CIAM tenant has no trust relationship into the corporate tenant, so a compromise of the customer-facing estate has no path to an administrative role.
Partner access is B2B collaboration with cross-tenant access settings, and MFA satisfied in the partner's home tenant is trusted. That is a deliberate transfer of part of the assurance to 34 organisations, reviewed annually.
The tenant a subject came from is a claim, never a parameter. Any API that accepted a tenant identifier from the caller would defeat every control in view 25.

Social federation with Google and Apple, plus local accounts. Email OTP is a step-up rather than a primary factor, and passkeys are the direction of travel.
Sign-up is self-service with progressive profiling; identity proofing is out of scope for this platform and belongs with the onboarding product.
Customer tokens carry a customer_id mapped from the subject, so the application never joins on an email address.

Guests inherit access through nested groups if the group model is not flat. Nesting is capped at two levels and reviewed every 90 days (view 27, row 5).
A partner tenant with weak MFA weakens the guest path. Cross-tenant settings are per-partner, so a specific partner can be downgraded to local MFA without changing the model.
1.2M customer identities make the CIAM tenant a target in its own right. It has its own Conditional Access estate, its own risk policies and its own Sentinel workspace.