Merge branch 'main' into EntraIdPython

Author: mrm9084

articles/active-directory-b2c/best-practices.md

@@ -18,6 +18,8 @@ ms.subservice: b2c
 ---
 
 # Recommendations and best practices for Azure Active Directory B2C
+[!INCLUDE [active-directory-b2c-identity-protection-retirement](../../includes/active-directory-b2c-identity-protection-retirement.md)]
+
 [!INCLUDE [active-directory-b2c-end-of-sale-notice-b](../../includes/active-directory-b2c-end-of-sale-notice-b.md)]
 
 The following best practices and recommendations cover some of the primary aspects of integrating Azure Active Directory (Azure AD) B2C into existing or new application environments.

articles/active-directory-b2c/billing.md

@@ -19,6 +19,8 @@ ms.custom:
 ---
 
 # Billing model for Azure Active Directory B2C
+[!INCLUDE [active-directory-b2c-identity-protection-retirement](../../includes/active-directory-b2c-identity-protection-retirement.md)]
+
 [!INCLUDE [active-directory-b2c-end-of-sale-notice-b](../../includes/active-directory-b2c-end-of-sale-notice-b.md)]
 
 Azure Active Directory B2C (Azure AD B2C) pricing is based on monthly active users (MAU), which is the count of unique users with authentication activity within a calendar month. This billing model applies to both Azure AD B2C tenants and [Microsoft Entra guest user collaboration (B2B)](../active-directory/external-identities/external-identities-pricing.md). MAU billing helps you reduce costs by offering a free tier and flexible, predictable pricing. 

articles/active-directory-b2c/conditional-access-identity-protection-overview.md

@@ -16,6 +16,8 @@ ms.custom: sfi-ropc-nochange
 ---
 
 # Identity Protection and Conditional Access for Azure AD B2C
+[!INCLUDE [active-directory-b2c-identity-protection-retirement](../../includes/active-directory-b2c-identity-protection-retirement.md)]
+
 [!INCLUDE [active-directory-b2c-end-of-sale-notice-b](../../includes/active-directory-b2c-end-of-sale-notice-b.md)]
 
 Enhance the security of Azure Active Directory B2C (Azure AD B2C) with Microsoft Entra ID Protection and Conditional Access. The Identity Protection risk-detection features, including risky users and risky sign-ins, are automatically detected and displayed in your Azure AD B2C tenant. You can create Conditional Access policies that use these risk detections to determine actions and enforce organizational policies. Together, these capabilities give Azure AD B2C application owners greater control over risky authentications and access policies.

articles/active-directory-b2c/conditional-access-user-flow.md

@@ -20,6 +20,8 @@ ms.custom:
 ---
 
 # Add Conditional Access to user flows in Azure Active Directory B2C
+[!INCLUDE [active-directory-b2c-identity-protection-retirement](../../includes/active-directory-b2c-identity-protection-retirement.md)]
+
 [!INCLUDE [active-directory-b2c-end-of-sale-notice-b](../../includes/active-directory-b2c-end-of-sale-notice-b.md)]
 
 [!INCLUDE [active-directory-b2c-choose-user-flow-or-custom-policy](../../includes/active-directory-b2c-choose-user-flow-or-custom-policy.md)]

articles/active-directory-b2c/custom-policy-developer-notes.md

@@ -19,6 +19,8 @@ ms.subservice: b2c
 ---
 
 # Developer notes for Azure Active Directory B2C
+[!INCLUDE [active-directory-b2c-identity-protection-retirement](../../includes/active-directory-b2c-identity-protection-retirement.md)]
+
 [!INCLUDE [active-directory-b2c-end-of-sale-notice-b](../../includes/active-directory-b2c-end-of-sale-notice-b.md)]
 
 Azure Active Directory B2C [user flows and custom policies](user-flow-overview.md) are generally available. Azure AD B2C capabilities are under continual development, so although most features are generally available, some features are at different stages in the software release cycle. This article discusses cumulative improvements in Azure AD B2C and specifies feature availability.

articles/active-directory-b2c/faq.yml

@@ -321,3 +321,25 @@ sections:
           In Azure AD B2C, I revoke all sessions of a user by using the Azure portals Revoke sessions button, but it doesn't work.
         answer: |
           Currently, Azure AD B2C doesn't support user session revocation from the Azure portal. However, you can achieve this task by using [Microsoft Graph PowerShell](manage-users-portal.md#revoke-a-consumer-users-session) or [Microsoft Graph API](/graph/api/user-revokesigninsessions).
+  - name: Azure AD External Identities P2 retirement
+    questions:
+      - question: |
+          What happened to Azure AD External Identities P2 in B2C tenants?
+        answer: |
+          Azure AD External Identities P2 has been retired in Azure AD B2C tenants. P2-only features are no longer available.
+      - question: |
+          Does the retirement affect workforce tenants?
+        answer: |
+          No. ID Protection remains available for business guests in workforce tenants as part of Azure AD External Identities P2. The retirement applies only to B2C tenants.
+      - question: |
+          What should I do if I was using P2 ID Protection in my B2C tenant?
+        answer: |
+          To continue protecting against identity-based risks in B2C, consider integrating a [partner identity verification provider](identity-verification-proofing.md). All P2 tenants will be automatically switched to P1 on a rolling basis by the end of March 2026.
+      - question: |
+          Will I still be billed for P2 after the retirement?
+        answer: |
+          Your B2C tenant will be automatically switched to P1 by the end of March 2026 and you will be billed at P1 pricing. For guidance on changing your pricing tier, see [Azure AD B2C billing](billing.md).
+      - question: |
+          Is the P2 retirement related to the Azure AD B2C end of sale?
+        answer: |
+          These are separate topics. The end of sale means Azure AD B2C is no longer available to new customers as of May 2025. The P2 retirement specifically retires the P2 pricing tier and ID Protection in B2C tenants. Existing B2C customers on P1 can continue using the service.

articles/active-directory-b2c/identity-protection-investigate-risk.md

@@ -17,6 +17,8 @@ ms.custom: sfi-image-nochange
 
 # Investigate risk with Identity Protection in Azure AD B2C
 
+[!INCLUDE [active-directory-b2c-identity-protection-retirement](../../includes/active-directory-b2c-identity-protection-retirement.md)]
+
 [!INCLUDE [active-directory-b2c-end-of-sale-notice-b](../../includes/active-directory-b2c-end-of-sale-notice-b.md)]
 
 Identity Protection provides ongoing risk detection for your Azure AD B2C tenant. It allows organizations to discover, investigate, and remediate identity-based risks. Identity Protection comes with risk reports that can be used to investigate identity risks in Azure AD B2C tenants. In this article, you learn how to investigate and mitigate risks.

articles/active-directory-b2c/identity-verification-proofing.md

@@ -15,8 +15,11 @@ ms.author: gasinh
 
 # Identity verification and proofing partners
 
+[!INCLUDE [active-directory-b2c-identity-protection-retirement](../../includes/active-directory-b2c-identity-protection-retirement.md)]
+
 [!INCLUDE [active-directory-b2c-end-of-sale-notice-b](../../includes/active-directory-b2c-end-of-sale-notice-b.md)]
 
+
 With Azure Active Directory B2C (Azure AD B2C) and solutions from software-vendor partners, customers can enable end-user identity verification and proofing for account registration. Identity verification and proofing can check documents, knowledge-based information, and liveness.
 
 ## Architecture diagram

articles/active-directory-b2c/security-architecture.md

@@ -20,6 +20,8 @@ ms.subservice: b2c
 
 # How to secure your Azure Active Directory B2C identity solution
 
+[!INCLUDE [active-directory-b2c-identity-protection-retirement](../../includes/active-directory-b2c-identity-protection-retirement.md)]
+
 This article provides the best practices in securing your Azure Active Directory B2C (Azure AD B2C) solution. To build your identity solution using Azure AD B2C involves many components that you should consider protecting and monitoring.  
 
 Depending on your solution, you have one or more of the following components in scope:

articles/active-directory-b2c/supported-azure-ad-features.md

@@ -19,8 +19,11 @@ ms.subservice: b2c
 
 # Supported Microsoft Entra ID features
 
+[!INCLUDE [active-directory-b2c-identity-protection-retirement](../../includes/active-directory-b2c-identity-protection-retirement.md)]
+
 [!INCLUDE [active-directory-b2c-end-of-sale-notice-b](../../includes/active-directory-b2c-end-of-sale-notice-b.md)]
 
+
 An Azure Active Directory B2C (Azure AD B2C) tenant is different than a Microsoft Entra tenant, which you may already have, but it relies on it. The following Microsoft Entra ID features can be used in your Azure AD B2C tenant.
 
 |Feature  |Microsoft Entra ID  | Azure AD B2C |