Your app has its own username and password table. Then leadership decides everyone needs to log in through SSO — and now every existing user, every stored credential, and every login flow you've already built has to change.

In this hands-on session, you migrate a real application from local authentication to an external identity provider, working against a pre-configured Microsoft Entra External ID tenant provided for the workshop — no setup required. We use Entra as the working example, but the decisions apply whether you land on Entra, Okta, Auth0, or anywhere else: mapping existing user records to identities in the new provider, managing the cutover period where some users are migrated and others aren't, safely invalidating old credentials, and what an actual rollback plan looks like when something doesn't go as planned.

The hands-on lab uses a C# sample application — you don't need production C# experience, just enough comfort reading code to follow along — but the migration decisions themselves apply regardless of what your own application is written in.

You'll leave with a migration checklist you can apply against your own user store, regardless of which identity provider you land on.