Switch identity providers in phases, with a fallback at every step

Accounts, apps and sign-in flows come across from Okta, Azure AD B2C, Auth0 or a login system you wrote yourself.

Sound familiar?

Which of these sounds like your team?

Azure AD B2C has stopped selling

Microsoft stopped offering it to new customers in May 2025 and will keep supporting existing tenants through May 2030 at the earliest.

Growth that costs you more

Your identity vendor charges per user, so each new customer adds to the bill.

Someone else holds your user base

Accounts, profiles and credentials live on a platform you don't run.

A forced reset for everyone

Asking every user to choose a new password means frustrated users and a busy help desk.

A long list of connected apps

None of them can lose sign-in while the move is under way.

Login code you wrote yourself

Every security fix and new feature for it lands on your own developers.

Process

How we work

  1. 01

    Catalogue

    We start by mapping everything your current provider does for you today.

  2. 02

    Pilot

    One application and a handful of test accounts go first, so problems show up while they are small.

  3. 03

    Move in waves

    We cut applications over in batches. If one has trouble, it can point back at the old provider.

  4. 04

    Close the old account

    When the last application has moved, the previous provider is decommissioned.

Specifics

Technical details

  • Nothing moves until we know every account type, connected app, login flow and custom rule
  • Attributes, groups and roles from the old provider are translated into Keycloak's model of realms, client roles and groups
  • Where the old provider lets you export password hashes in an algorithm Keycloak supports, we import them; otherwise each user is moved the first time they sign in
  • Apps get new OIDC or SAML settings that point to Keycloak, and we test logins in each one
  • After the move, users still find their MFA, your branding and their social login options
  • At every stage of the switch, traffic can return to the previous provider

Options

Flexible to fit you

  • Switch every application on one dayorBring applications across in batches
  • Carry existing passwords over as hashesorLet each person's first login complete their move
  • Keycloak hosted in your cloud accountorKeycloak on hardware you own
  • Grootan keeps Keycloak runningorOwnership passes to your team

Measurement

What we measure

  • How far through your user base the move has got
  • Whether people sign in without trouble on Keycloak
  • Help-desk load in the weeks after cutover
  • How many of your apps now authenticate against Keycloak

FAQ

Questions we hear

Will our users need new passwords?

Usually not. If the old provider hands over password hashes we can use, people sign in exactly as before. If not, Keycloak picks up each password the first time that person logs in.

How long can we stay on Azure AD B2C?

Existing customers have Microsoft support through May 2030 at the earliest. New sign-ups ended on 1 May 2025, so there is time to plan a careful move rather than a rushed one.

Which providers can you move us away from?

Azure AD B2C, Okta and Auth0 are covered, as are login systems teams built themselves. If yours is something else, ask.

What decides the price of a migration?

It varies with how large and complicated the move is. A first call is where we work that out together.

Let's map your route to Keycloak

Related

More Keycloak services