0

If I add Azure AD as an IDP to B2C using a built-in sign-up policy and sign-up with an existing Azure AD user (i.e. federation), the "placeholder" on B2C has a source of "Federated Azure Active Directory". The signed-up user has a UPN.

I can't seem to sign-in to B2C using a custom sign-in policy with that user name?

It says "Account does not exist. Please sign-up". I assume you can't mix and match built-in and custom?

I have to sign-up and sign-in using custom policies to get the sign-in to work.

In this case, the source of the "placeholder" is "Other".

The problem is that this signed-up user does not have a UPN.

Is there a way to get a UPN?

Or is this by design?

rbrayb
  • 46,440
  • 34
  • 114
  • 174
  • Thanks @rbryab and please follow the document and let us know if you need more information - https://stackoverflow.com/questions/51752979/azure-b2c-ad-is-the-email-address-mandatory-for-local-accounts-identity-provide – Jit_MSFT Mar 22 '21 at 12:13
  • Thanks, @Jit_MSFT. But that article refers to having to provide an email address when you use username. My question is around why federation is different between built-in and custom policies. In particular, custom policies do not provide a UPN on signup and I need it. I cannot ask the user to enter a UPN when they sign-up! – rbrayb Mar 22 '21 at 19:26

1 Answers1

1

The reason is, the Issuer used in user flow is different to custom policy.

If you return the user via MS Graph (beta version), compare the Identities array of a user signed up via custom policy versus user flow (for AAD). The issuer will be different (login.microsoftonline.com vs sts.windows.net). The combination of Issuer and AAD objectId are used to create and locate the user. Due to the mismatch, a user signed up via AAD federation with a user flow can’t sign in via custom policy, account won’t be found.

By analysing the Identities object on the users, you can take the value of the Issuer property on the account created with user flow, and insert it into your AAD Custom Policy Technical Profile for the claim called “IdentityProvider”.

Change this

<OutputClaim ClaimTypeReferenceId="identityProvider" PartnerClaimType="iss" />

To

<OutputClaim ClaimTypeReferenceId="identityProvider" DefaultValue=“ISSUER FROM USER FLOW USER” />

https://learn.microsoft.com/en-us/azure/active-directory-b2c/identity-provider-azure-ad-single-tenant?pivots=b2c-custom-policy#configure-azure-ad-as-an-identity-provider-1

Jas Suri - MSFT
  • 10,605
  • 2
  • 10
  • 20