title: Azure Active Directory (B2E) vs Azure Active Directory B2C - the information out there is ambiguous and difficult to follow
body: <p>Dear Microsoft Azure AD personnel, (and anyone else who has been down this road)</p>
  
  <p>We are building a User Interface as a front-end to our back-end architecture in Azure, mainly comprised of Azure SQL databases, VM clusters, Azure Search indexes, and SFC's. </p>
  
  <p>Users who will login to this UI will be both internal (company employees) and external (our clients).  The internal users will log in to perform various functions for services we provide our clients.  Our clients will log in to perform search queries on certain tables of our databases.</p>
  
  <p>Where we are lost is in the area of trying to plan and execute our identity management architecture along the lines of permissions and policies.  </p>
  
  <p>For our <strong>internal users</strong>, we will have several different permissions profiles that need to be defined - for example, User 1 should be able to access and write information about client 1, but not client 2.  User 2 should be able to access and write information about client 2 and client 3, but not client 1.  That is just a simple example.</p>
  
  <p>For our <strong>clients</strong>, thus far, we have set a up a B2C tenant to allow them to sign-up for access with their email address.  While this part is simple and straight-forward, it seems the B2C functionality is rather limited in that there are only policies for signup/sign-in, password reset, and profile editing.  We will eventually need to offer different levels of access permissions to our clients as well.</p>
  
  <p>Here are my questions:</p>
  
  <ol>
  <li><p>For our internal users, should we be using our domain Azure AD (B2E), or should we also use B2C for them so <strong>all</strong> users are under the B2C architecture?</p></li>
  <li><p>Are these different kinds of permissions I've mentioned defined and set inside Active Directory settings, or coded into the Application?</p></li>
  <li><p>Should we use B2C at all, given that we will need to give different permissions structures to different users within our clients?  Should we be using B2E for our clients as well, even though they are customers and not internal users on our domain?</p></li>
  </ol>
  
  <p>I've been reading Azure documentation and watching videos since end of last week and I'm still having trouble determining what's right for us for what we're trying to accomplish.</p>