Merge pull request #313184 from MicrosoftDocs/main

learn-build-service-prod[bot] · web-flow · commit 0257c62946ea · 2026-03-16T11:07:20.000Z
Auto Publish – main to live - 2026-03-16 11:00 UTC
diff --git a/articles/active-directory-b2c/best-practices.md b/articles/active-directory-b2c/best-practices.md
@@ -18,6 +18,8 @@ ms.subservice: b2c
 ---
 
 # Recommendations and best practices for Azure Active Directory B2C
+[!INCLUDE [active-directory-b2c-identity-protection-retirement](../../includes/active-directory-b2c-identity-protection-retirement.md)]
+
 [!INCLUDE [active-directory-b2c-end-of-sale-notice-b](../../includes/active-directory-b2c-end-of-sale-notice-b.md)]
 
 The following best practices and recommendations cover some of the primary aspects of integrating Azure Active Directory (Azure AD) B2C into existing or new application environments.
diff --git a/articles/active-directory-b2c/billing.md b/articles/active-directory-b2c/billing.md
@@ -19,6 +19,8 @@ ms.custom:
 ---
 
 # Billing model for Azure Active Directory B2C
+[!INCLUDE [active-directory-b2c-identity-protection-retirement](../../includes/active-directory-b2c-identity-protection-retirement.md)]
+
 [!INCLUDE [active-directory-b2c-end-of-sale-notice-b](../../includes/active-directory-b2c-end-of-sale-notice-b.md)]
 
 Azure Active Directory B2C (Azure AD B2C) pricing is based on monthly active users (MAU), which is the count of unique users with authentication activity within a calendar month. This billing model applies to both Azure AD B2C tenants and [Microsoft Entra guest user collaboration (B2B)](../active-directory/external-identities/external-identities-pricing.md). MAU billing helps you reduce costs by offering a free tier and flexible, predictable pricing. 
diff --git a/articles/active-directory-b2c/conditional-access-identity-protection-overview.md b/articles/active-directory-b2c/conditional-access-identity-protection-overview.md
@@ -16,6 +16,8 @@ ms.custom: sfi-ropc-nochange
 ---
 
 # Identity Protection and Conditional Access for Azure AD B2C
+[!INCLUDE [active-directory-b2c-identity-protection-retirement](../../includes/active-directory-b2c-identity-protection-retirement.md)]
+
 [!INCLUDE [active-directory-b2c-end-of-sale-notice-b](../../includes/active-directory-b2c-end-of-sale-notice-b.md)]
 
 Enhance the security of Azure Active Directory B2C (Azure AD B2C) with Microsoft Entra ID Protection and Conditional Access. The Identity Protection risk-detection features, including risky users and risky sign-ins, are automatically detected and displayed in your Azure AD B2C tenant. You can create Conditional Access policies that use these risk detections to determine actions and enforce organizational policies. Together, these capabilities give Azure AD B2C application owners greater control over risky authentications and access policies.
diff --git a/articles/active-directory-b2c/conditional-access-user-flow.md b/articles/active-directory-b2c/conditional-access-user-flow.md
@@ -20,6 +20,8 @@ ms.custom:
 ---
 
 # Add Conditional Access to user flows in Azure Active Directory B2C
+[!INCLUDE [active-directory-b2c-identity-protection-retirement](../../includes/active-directory-b2c-identity-protection-retirement.md)]
+
 [!INCLUDE [active-directory-b2c-end-of-sale-notice-b](../../includes/active-directory-b2c-end-of-sale-notice-b.md)]
 
 [!INCLUDE [active-directory-b2c-choose-user-flow-or-custom-policy](../../includes/active-directory-b2c-choose-user-flow-or-custom-policy.md)]
diff --git a/articles/active-directory-b2c/custom-policy-developer-notes.md b/articles/active-directory-b2c/custom-policy-developer-notes.md
@@ -19,6 +19,8 @@ ms.subservice: b2c
 ---
 
 # Developer notes for Azure Active Directory B2C
+[!INCLUDE [active-directory-b2c-identity-protection-retirement](../../includes/active-directory-b2c-identity-protection-retirement.md)]
+
 [!INCLUDE [active-directory-b2c-end-of-sale-notice-b](../../includes/active-directory-b2c-end-of-sale-notice-b.md)]
 
 Azure Active Directory B2C [user flows and custom policies](user-flow-overview.md) are generally available. Azure AD B2C capabilities are under continual development, so although most features are generally available, some features are at different stages in the software release cycle. This article discusses cumulative improvements in Azure AD B2C and specifies feature availability.
diff --git a/articles/active-directory-b2c/faq.yml b/articles/active-directory-b2c/faq.yml
@@ -321,3 +321,25 @@ sections:
           In Azure AD B2C, I revoke all sessions of a user by using the Azure portals Revoke sessions button, but it doesn't work.
         answer: |
           Currently, Azure AD B2C doesn't support user session revocation from the Azure portal. However, you can achieve this task by using [Microsoft Graph PowerShell](manage-users-portal.md#revoke-a-consumer-users-session) or [Microsoft Graph API](/graph/api/user-revokesigninsessions).
+  - name: Azure AD External Identities P2 retirement
+    questions:
+      - question: |
+          What happened to Azure AD External Identities P2 in B2C tenants?
+        answer: |
+          Azure AD External Identities P2 has been retired in Azure AD B2C tenants. P2-only features are no longer available.
+      - question: |
+          Does the retirement affect workforce tenants?
+        answer: |
+          No. ID Protection remains available for business guests in workforce tenants as part of Azure AD External Identities P2. The retirement applies only to B2C tenants.
+      - question: |
+          What should I do if I was using P2 ID Protection in my B2C tenant?
+        answer: |
+          To continue protecting against identity-based risks in B2C, consider integrating a [partner identity verification provider](identity-verification-proofing.md). All P2 tenants will be automatically switched to P1 on a rolling basis by the end of March 2026.
+      - question: |
+          Will I still be billed for P2 after the retirement?
+        answer: |
+          Your B2C tenant will be automatically switched to P1 by the end of March 2026 and you will be billed at P1 pricing. For guidance on changing your pricing tier, see [Azure AD B2C billing](billing.md).
+      - question: |
+          Is the P2 retirement related to the Azure AD B2C end of sale?
+        answer: |
+          These are separate topics. The end of sale means Azure AD B2C is no longer available to new customers as of May 2025. The P2 retirement specifically retires the P2 pricing tier and ID Protection in B2C tenants. Existing B2C customers on P1 can continue using the service.
diff --git a/articles/active-directory-b2c/identity-protection-investigate-risk.md b/articles/active-directory-b2c/identity-protection-investigate-risk.md
@@ -17,6 +17,8 @@ ms.custom: sfi-image-nochange
 
 # Investigate risk with Identity Protection in Azure AD B2C
 
+[!INCLUDE [active-directory-b2c-identity-protection-retirement](../../includes/active-directory-b2c-identity-protection-retirement.md)]
+
 [!INCLUDE [active-directory-b2c-end-of-sale-notice-b](../../includes/active-directory-b2c-end-of-sale-notice-b.md)]
 
 Identity Protection provides ongoing risk detection for your Azure AD B2C tenant. It allows organizations to discover, investigate, and remediate identity-based risks. Identity Protection comes with risk reports that can be used to investigate identity risks in Azure AD B2C tenants. In this article, you learn how to investigate and mitigate risks.
diff --git a/articles/active-directory-b2c/identity-verification-proofing.md b/articles/active-directory-b2c/identity-verification-proofing.md
@@ -15,8 +15,11 @@ ms.author: gasinh
 
 # Identity verification and proofing partners
 
+[!INCLUDE [active-directory-b2c-identity-protection-retirement](../../includes/active-directory-b2c-identity-protection-retirement.md)]
+
 [!INCLUDE [active-directory-b2c-end-of-sale-notice-b](../../includes/active-directory-b2c-end-of-sale-notice-b.md)]
 
+
 With Azure Active Directory B2C (Azure AD B2C) and solutions from software-vendor partners, customers can enable end-user identity verification and proofing for account registration. Identity verification and proofing can check documents, knowledge-based information, and liveness.
 
 ## Architecture diagram
diff --git a/articles/active-directory-b2c/security-architecture.md b/articles/active-directory-b2c/security-architecture.md
@@ -20,6 +20,8 @@ ms.subservice: b2c
 
 # How to secure your Azure Active Directory B2C identity solution
 
+[!INCLUDE [active-directory-b2c-identity-protection-retirement](../../includes/active-directory-b2c-identity-protection-retirement.md)]
+
 This article provides the best practices in securing your Azure Active Directory B2C (Azure AD B2C) solution. To build your identity solution using Azure AD B2C involves many components that you should consider protecting and monitoring.  
 
 Depending on your solution, you have one or more of the following components in scope:
diff --git a/articles/active-directory-b2c/supported-azure-ad-features.md b/articles/active-directory-b2c/supported-azure-ad-features.md
@@ -19,8 +19,11 @@ ms.subservice: b2c
 
 # Supported Microsoft Entra ID features
 
+[!INCLUDE [active-directory-b2c-identity-protection-retirement](../../includes/active-directory-b2c-identity-protection-retirement.md)]
+
 [!INCLUDE [active-directory-b2c-end-of-sale-notice-b](../../includes/active-directory-b2c-end-of-sale-notice-b.md)]
 
+
 An Azure Active Directory B2C (Azure AD B2C) tenant is different than a Microsoft Entra tenant, which you may already have, but it relies on it. The following Microsoft Entra ID features can be used in your Azure AD B2C tenant.
 
 |Feature  |Microsoft Entra ID  | Azure AD B2C |
diff --git a/articles/active-directory-b2c/technical-overview.md b/articles/active-directory-b2c/technical-overview.md
@@ -16,8 +16,11 @@ ms.custom: sfi-image-nochange
 
 # Technical and feature overview of Azure Active Directory B2C
 
+[!INCLUDE [active-directory-b2c-identity-protection-retirement](../../includes/active-directory-b2c-identity-protection-retirement.md)]
+
 [!INCLUDE [active-directory-b2c-end-of-sale-notice-b](../../includes/active-directory-b2c-end-of-sale-notice-b.md)]
 
+
 This article is a companion to [About Azure Active Directory B2C](overview.md) and provides a more in-depth introduction to the service. We will discuss here the primary resources you work with in the service, its features and learn how they enable you to provide a fully custom identity experience for customers in your applications.
 
 ## Azure AD B2C tenant
diff --git a/articles/azure-app-configuration/concept-hyperscale-client-configuration.md b/articles/azure-app-configuration/concept-hyperscale-client-configuration.md
@@ -63,9 +63,7 @@ Configure one or more filters to control which requests are allowed to pass thro
 
 - Configure Azure Front Door filters to precisely match your application's configuration requirements. Only expose the exact key patterns your application uses. For example, if your application loads keys with the `"App1:"` prefix, configure the Azure Front Door rule to allow only `"App1:"` keys, not broader patterns like `"App"`.
 
-- If your application loads feature flags, provide `".appconfig.featureflag/{YOUR-FEATURE-FLAG-PREFIX}"` filter for the Key with *Starts with* operator.
-
-- If you're using App Configuration provider libraries and your application loads ONLY feature flags, you should add two key filters in the Azure Front Door rules - one for `ALL` keys with no label and second for all keys starting with `".appconfig.featureflag/{YOUR-FEATURE-FLAG-PREFIX}"`. This is because App Configuration provider libraries load all key-values with no label by default when no key-value selector is specified. 
+- If you're using App Configuration provider libraries and your application loads ONLY feature flags, you should add two filters in the Azure Front Door rules - a key-value filter for ALL keys with no label and a feature flag filter for all keys starting with your feature flag prefix. This is because App Configuration provider libraries load all key-values with no label by default when no key-value selector is specified. 
 
 #### Request scoping through multiple Azure Front Door endpoints
 
diff --git a/articles/azure-app-configuration/how-to-connect-azure-front-door.md b/articles/azure-app-configuration/how-to-connect-azure-front-door.md
@@ -90,14 +90,12 @@ Create a new Azure Front Door profile and connect it to your App Configuration s
    > [!NOTE]
    > To configure scoping filters correctly, ensure that the prefix filter in Azure Front Door exactly matches the selector your application uses to load keys from App Configuration. For example, if your application loads keys using the prefix "App1:", configure the same Starts with = "App1:" key filter in Azure Front Door. If your application instead uses a more specific key prefix such as "App1:Version", but Azure Front Door is allowlisted for "App1:" key filter (or vice versa), the request will be rejected because the selectors do not match exactly. See [examples for matching application filters with endpoint filters](https://github.com/Azure/AppConfiguration/blob/main/docs/AzureFrontDoor/readme.md).
 
-   - **Key**: The key filter to apply when querying Azure App Configuration for key-values. Reserved characters: asterisk (`*`), comma (`,`), and backslash (`\`) must be escaped using a backslash (`\`) when filtering multiple key-values.
+   - **Key of key-value filter**: The key filter to apply when querying Azure App Configuration for key-values. Reserved characters: asterisk (`*`), comma (`,`), and backslash (`\`) must be escaped using a backslash (`\`) when filtering multiple key-values.
    - **Label**: The label filter to apply when querying Azure App Configuration for key-values. Reserved characters: asterisk (`*`), comma (`,`), and backslash (`\`) must be escaped using a backslash (`\`) when filtering multiple key-values.
    - **Tags**: The tag name and value filter to apply when querying Azure App Configuration for key-values. Reserved characters: asterisk (`*`), comma (`,`), backslash (`\`), and equals (`=`) must always be escaped using a backslash (`\`).
+   - **Key of feature flag filter**: The filter to apply to feature flag names when querying Azure App Configuration for feature flags. Reserved characters: asterisk (`*`), comma (`,`), and backslash (`\`) must be escaped using a backslash (`\`) when filtering multiple feature flags. The reserved feature flag prefix `.appconfig.featureflag/` will be automatically appended to every feature flag key filter.
    - **Snapshot name**: Name of snapshot whose content should be accessible through this Azure Front Door endpoint. You can select one or more snapshots to restrict access to specific snapshots.
 
-   > [!NOTE]
-   > If your application loads feature flags, provide ".appconfig.featureflag/{YOUR-FEATURE-FLAG-PREFIX}" filter for the Key with *Starts with* operator.
-
 
 1. Select **Create & Connect** to create the profile and establish the connection.
 
diff --git a/articles/azure-app-configuration/how-to-load-azure-front-door-configuration-provider.md b/articles/azure-app-configuration/how-to-load-azure-front-door-configuration-provider.md
@@ -77,9 +77,9 @@ For a complete sample app, refer to [JavaScript App with Azure App Configuration
 ## Considerations and edge cases
 
 - **Request scoping**: The key-value filters used by your application must match exactly the filters configured for the Azure Front Door endpoint; any mismatch will cause the request to be rejected. For example, if your endpoint is configured to allow access to keys starting with an "App1:" prefix, the application code must also load keys starting with "App1:". However, if your application loads keys starting with a more specific prefix like "App1:Prod:", the request is rejected. See [examples for matching application filters with endpoint filters](https://github.com/Azure/AppConfiguration/blob/main/docs/AzureFrontDoor/readme.md).
-- **Exclusively loading feature flags**: If your application loads only feature flags, you should add two key filters in the Azure Front Door rules - one for ALL keys with no label and second for all keys starting with ".appconfig.featureflag/{YOUR-FEATURE-FLAG-PREFIX}".
+- **Exclusively loading feature flags**: If your application loads only feature flags, you should add two filters in the Azure Front Door rules - one a key-value filter for ALL keys with no label and second a feature flag filter for all keys starting with your feature flag prefix.
 - **Refresh strategy**: Applications loading from Azure Front Door cannot use sentinel key refresh. If refresh is enabled, the application must be configured to [monitor all selected keys](./howto-best-practices.md#monitoring-all-selected-keys) for changes.
-- **Snapshot references**: If your application loads a key-value that is a [snapshot reference](./concept-snapshot-references.md), Azure Front Door must be configured to allowlist the referenced snapshot. Include the snapshot name in your Azure Front Door filters to enable snapshot resolution.
+- **Snapshot references**: If your application loads a key-value that is a [snapshot reference](./concept-snapshot-references.md), Azure Front Door must be configured to allow list the referenced snapshot. Include the snapshot name in your Azure Front Door filters to enable snapshot resolution.
 
 ## Troubleshooting
 
diff --git a/articles/azure-app-configuration/media/how-to-connect-azure-front-door/endpoint-details.png b/articles/azure-app-configuration/media/how-to-connect-azure-front-door/endpoint-details.png
diff --git a/articles/energy-data-services/how-to-deploy-gcz.md b/articles/energy-data-services/how-to-deploy-gcz.md
diff --git a/articles/energy-data-services/includes/how-to/how-to-deploy-gcz/deploy-gcz-on-aks.md b/articles/energy-data-services/includes/how-to/how-to-deploy-gcz/deploy-gcz-on-aks.md
diff --git a/articles/energy-data-services/includes/how-to/how-to-deploy-gcz/deploy-gcz-on-windows.md b/articles/energy-data-services/includes/how-to/how-to-deploy-gcz/deploy-gcz-on-windows.md
diff --git a/includes/active-directory-b2c-identity-protection-retirement.md b/includes/active-directory-b2c-identity-protection-retirement.md
