Compare
Microsoft Entra External ID is Microsoft's CIAM (the successor to Azure AD B2C, which is end-of-sale for new customers since May 2025). It's cloud-only and Azure-bound; choose Qeet ID when you want open-source code, self-hosting, readable pricing, and governance without separately-metered add-ons.
Qeet ID
- License
- MIT (open source)
- Self-host
- First-class
- Pricing
- Linear per-MAU
- Stack
- Go + Postgres
- Cloud lock-in
- None
Microsoft Entra External ID
- License
- Proprietary (Azure)
- Self-host
- Not available
- Pricing
- 50k MAU free, then per-MAU
- Stack
- Closed (Azure)
- Compliance
- SOC 2 / ISO
CIAM you can read, run anywhere, and self-host.
Qeet ID matches Entra External ID's core protocols, but the code is open, the pricing is on the page, and governance isn't a separately-metered add-on.
Feature-by-feature
Verified against Qeet ID's implemented status and Microsoft Entra External ID's public docs. Where we're still building, we say so.
- Available
- Partial / gated
- Not offered
| Capability | Qeet ID | Microsoft Entra External ID |
|---|---|---|
| Authentication | ||
Email + password (Argon2id + HIBP) | Yes | Yes |
Passkeys / WebAuthn | Yes | Yes |
Social login (Google, Apple, GitHub, Microsoft, …) | Yes | Yes |
MFA (TOTP, SMS, email, recovery codes) | Yes | Yes |
| Federation | ||
OAuth 2.0 / OIDC (you are the IdP) | Yes | Yes |
SAML 2.0 SP + IdP | Yes | Yes |
SCIM 2.0 provisioning | Yes | Yes |
| Authorization | ||
RBAC + single-call /check API Entra exposes app roles / claims; Qeet ID ships a single-call /check authorization API. | Yes | App roles |
Explainable authz (grant-path “why?” trace) | Yes | No |
Multi-tenant isolation by default (Postgres RLS) | Yes | Azure tenant |
| Deployment | ||
Open-source code (MIT) | Yes | No |
Self-host (single binary + Postgres) | Yes | No |
Runs without a cloud subscription Entra External ID requires an Azure subscription; Qeet ID runs on any cloud or air-gapped on-prem. | Yes | No |
| Pricing | ||
Free tier MAU cap Entra's free MAU tier is larger; Qeet ID's includes enterprise SSO with no add-ons. | 25,000 | 50,000 |
Readable published per-MAU pricing Entra's per-MAU rate sits behind the Azure calculator / sales, not a static price page. | Yes | No |
Governance without add-on metering Conditional access / ID Protection risk signals are separately-metered Entra add-ons. | Yes | No |
| Security & audit | ||
Tamper-evident hash-chained audit log + /verify Qeet ID SHA-256 chains every audit row; an integrity endpoint proves no row was altered. | Yes | Partial |
Refresh-token theft detection | Yes | Yes |
Adaptive / risk-based MFA + device signals Entra ID Protection ships adaptive risk (as a metered add-on); Qeet ID's is planned. | Roadmap | Yes |
| Compliance | ||
SOC 2 Type II / ISO 27001 Independent audit + external pen-test are scheduled before Qeet ID GA. | Roadmap (pre-GA) | Yes |
Self-hosted = your compliance boundary | Yes | No |
| Developer experience | ||
First-party SDKs | React · Node · Go | MSAL libraries |
Prebuilt React components / hosted flows Entra ships hosted user flows + MSAL React; Qeet ID's React component kit is in progress. | Partial | Yes |
Comparison is based on publicly-available product information at the time of writing. We do our best to be accurate — if anything above is wrong, please let us know and we'll correct it.
Migrate from Microsoft Entra External ID
Modern CIAM without the Azure lock-in
Run Qeet ID on any cloud or on-prem, or start free on our hosted plan — no Azure subscription required.