Entra External ID (External Tenant): How to send an email notification/invitation to local user created via "Create User" endpoint of Graph API

Hello everyone,

We are in the process of migrating our authentication provider from Auth0 to MS Entra External ID for External Tenants (B2C). We have a couple of workflows we need to replicate in MS Entra External ID, particularly Create User and Reset Password scenarios.

Current Workflow with Auth0

1. Our Single Page React Application provides a “Create User” form.
2. Upon form submission, our backend (NestJS) calls the Auth0 Management API to create a user with a random password.
3. Right after creation, we trigger the dbconnections/change_password API, which sends a “welcome” email to the newly created user.
4. The user receives an email containing a standard welcome message with a “Confirm Your Email” link.
5. Clicking this link redirects the user to Auth0’s password reset flow, where they can set their own password for the first time.

This flow eliminates the need to send the user a random password explicitly. Instead, the user receives a welcome email and uses a link to set their own password.

What We’ve Tried in MS Entra External ID

• Using the Microsoft Graph API, we can create a new user with a random password and set forceChangePasswordNextSignIn = true in the passwordProfile.
• The user is indeed required to change their password on first sign-in.
• However, we are missing two critical features:
  1. Sending a notification (like a “Your Account Has Been Created” email) to the newly created user.
  2. Providing a secure way for them to set their own password without sending the random temporary password in plain text via email.

Question

Is there a recommended way, out-of-the-box or via custom policies, to achieve this workflow in MS Entra External ID for B2C users (i.e. local accounts)? Specifically, can we create a new user via the Graph API and simultaneously trigger an email so that the user can complete their account setup (set their own password) without having to send a temporary password in plain text?

We’ve seen references to the “invitation” API, but that appears to be intended for Workforce tenants rather than External/B2C tenants. If there’s a similar functionality for B2C, or a best practice for implementing the same, we’d really appreciate any guidance or pointers. Any resources, documentation links, or suggestions would be greatly appreciated!

Thank you in advance for your help!