The identity provider landscape for .NET Core developers is broad enough to be genuinely confusing. The options range from managed SaaS platforms that cost nothing to get started and significant money at scale, to self-hosted open-source platforms that cost nothing in licensing and significant effort in operations, to building something yourself with frameworks like Duende IdentityServer.

The practitioner consensus is fairly clear on a few points: Azure B2C is painful, IdentityServer4 is effectively end-of-life, and the right answer between managed and self-hosted depends on your team's capacity and your cost sensitivity more than on any technical superiority.

This guide covers the main options, the actual tradeoffs practitioners have experienced, and how authentication connects to the enterprise identity governance layer that organizations manage once they have an IdP in place.

The Core Decision: Managed vs. Self-Hosted

Before comparing specific products, the meaningful decision is whether you want to own the identity infrastructure or pay someone else to own it.

Managed IdPs (Auth0, Okta, Azure Entra ID, Clerk, Kinde) handle security patching, MFA implementation, compliance, and availability. You configure, they operate. The trade-off is cost that scales with users and features, and dependency on a vendor's availability and pricing decisions.

Self-hosted IdPs (Keycloak, Authentik, Zitadel, Duende IdentityServer) give you complete control over user data, no per-user licensing, and unlimited customization. The trade-off is that you own a piece of security infrastructure, which means patching it, operating it, scaling it, and being responsible when something goes wrong.

The directional advice from practitioners who have been through this: if you are building for enterprise B2B customers who will want to federate with their own IdP, a managed platform reduces the integration complexity significantly. If you are cost-constrained and have the engineering capacity to operate infrastructure, Keycloak or Authentik covers the same functional requirements without licensing cost.

Managed IdP Options

Auth0

Auth0 consistently receives the best developer experience reviews in this category. The documentation is exceptional, the .NET Core quickstarts are genuinely useful, and the time from zero to working authentication is measured in minutes rather than hours.

The qualification: Auth0 gets expensive as you scale, particularly for enterprise features like organizations (multi-tenancy), advanced customization, and MFA beyond basic options. It is the easiest to start with and one of the more expensive at scale. For B2C applications with a large user base or for B2B applications requiring per-tenant customization, the pricing calculus matters.

Auth0 is also now part of Okta, which means the product roadmap and pricing are subject to enterprise software company dynamics. Worth factoring into long-term dependency decisions.

Azure Entra ID (formerly Azure AD)

For .NET Core applications targeting enterprise B2B customers, Azure Entra ID is the most seamless option. Microsoft owns both .NET and Entra, and the Microsoft.Identity.Web library makes integration straightforward. If your customers are already in the Microsoft ecosystem (most enterprise organizations are), federated SSO through Entra is what they expect.

The caveat is that Entra is best suited for internal and B2B scenarios. For customer-facing (B2C) scenarios with non-Microsoft users, the experience is less seamless.

Azure AD B2C

This comes up frequently in these conversations, almost always negatively. The configuration model involves XML policy files that require significant expertise. Changes to clients are not always reflected immediately. Documentation overlaps confusingly with Entra ID documentation. Features that exist in Entra are often not supported in B2C, but this is not always clear until you have already started building.

The developer experience assessment from the community is consistent: if you can use Entra ID instead of B2C, do. If you need B2C's specific capabilities (customer-facing auth with custom user flows), budget time for the learning curve.

Okta

Okta is the enterprise standard for B2B identity and has well-supported .NET Core SDKs. It offers more enterprise features than Auth0 (particularly around advanced RBAC and governance capabilities) at a correspondingly higher price point. For organizations where identity is a critical enterprise function and budget is not the primary constraint, Okta's depth is warranted. For smaller teams, the cost relative to Auth0 or Entra is difficult to justify.

Clerk and Kinde

Both are newer entrants (Clerk is well-funded; Kinde is earlier stage) that prioritize developer experience. Clerk in particular has strong React and Next.js integrations. .NET Core support is less central to their positioning. Worth evaluating if developer experience and fast integration are the primary criteria and you are not tied to .NET as your primary framework.

Self-Hosted Options

Keycloak

Keycloak is the most widely deployed self-hosted IdP in enterprise environments. It handles OIDC, SAML, and LDAP federation natively, supports multi-tenancy through realms, and has an active community. It is genuinely capable and widely trusted by organizations including the Porsche supplier chain, which gives some indication of enterprise credibility.

The operational complexity is real. Keycloak is not difficult to get running locally. Running it in production, maintaining it through upgrades, and customizing it for specific requirements all require more effort than managed alternatives. For teams with the capacity to own that infrastructure, the cost savings over managed platforms are significant at scale.

Authentik

Authentik has become a popular alternative to Keycloak specifically because the setup and configuration experience is substantially more approachable. Practitioners report getting OAuth integration working in ten minutes without reading documentation. The Forward Auth capability for protecting Nginx-backed services is particularly clean.

For teams that want self-hosted with a lower operational burden than Keycloak, Authentik is the current recommendation from most of the community.

Zitadel

Zitadel is a newer cloud-native option that supports multi-tenancy natively and has a modern API-first design. Self-hostable with a cloud option available. Less mature than Keycloak but rapidly developing and worth evaluating for teams that want something between Keycloak's complexity and the cost of managed platforms.

Duende IdentityServer (formerly IdentityServer4)

IdentityServer4 is end-of-life. The successor is Duende IdentityServer, which requires a commercial license for production use. Duende is not a turnkey solution; it is a framework for building your own identity provider. This means you are responsible for the UI, the user store, the token logic, and the ongoing security maintenance of all of it.

The community assessment: given Keycloak is free and production-ready, choosing Duende means either specific technical requirements that Keycloak does not meet, or preference for staying in .NET for the identity layer. The commercial license cost at Duende's pricing makes the "self-hosted to save money" argument less compelling.

The .NET Core Integration Reality

One point that gets lost in the IdP comparison is that from a .NET Core integration perspective, any OAuth2/OIDC-compliant provider works with the same middleware. The Microsoft.AspNetCore.Authentication.OpenIdConnect package handles the protocol; the configuration points at your chosen IdP's endpoints.

This means the selection decision is almost entirely about operational model, cost, and developer experience rather than about .NET compatibility. The one exception is if you have specific .NET-ecosystem integrations that favor Entra (like integration with Microsoft Graph or Azure services), where the native SDK support is a genuine advantage.

For multi-tenant .NET applications that need to authenticate against multiple customer-specific OIDC providers, this is also achievable with current .NET authentication middleware through dynamic provider registration.

Authentication vs. Governance: Where Enterprise IT Fits

If you are building internal tools or B2B applications, there is a layer above authentication that enterprise IT teams manage: identity governance.

The IdP you choose handles authentication: verifying who the user is and issuing tokens. Enterprise organizations layer an IGA platform above this to govern who should have access to your application, how that access is provisioned and deprovisioned, and whether access is periodically reviewed.

Zluri, which uses Auth0 and SSO internally for its own authentication, operates as the IGA layer above IdPs like Okta, Azure Entra ID, and Google Workspace. When an IT administrator onboards a new employee in Zluri, Zluri can automatically add the user to the correct SSO groups in the connected IdP, granting them access to the applications their role requires. When they leave, Zluri's offboarding playbook revokes that SSO access alongside access to every other connected application.

This is relevant context if you are building applications that will be managed by enterprise IT teams, because the decisions your enterprise customers have made about their IdP will affect how your application integrates with their governance workflows. Applications that support SAML and OIDC federation with major enterprise IdPs (Okta, Entra ID, Google Workspace) are easier for enterprise IT teams to manage and govern than applications that require custom authentication flows.

Practical Decision Framework

For most .NET Core teams, the decision simplifies to:

Already in Microsoft ecosystem, building for enterprise B2B: Entra ID. The integration is most seamless and enterprise customers expect it.

Building B2C or consumer-facing, developer experience is a priority, budget allows: Auth0. Best documentation, fastest path to working auth.

Cost-constrained, team has infrastructure capacity: Keycloak or Authentik. Authentik for easier setup, Keycloak for more mature enterprise features.

Need full control, specific requirements that managed platforms cannot meet: Keycloak first. Duende only if there are specific technical reasons to stay in the .NET identity framework stack.

Avoid: Azure AD B2C unless you have specific requirements that only it can meet and budget for the configuration learning curve.