Creating a user in Azure AD B2C through Microsoft SSO

I have a Microsoft SSO process and I can get the required information of the user in the response. Currently, I am creating my normal users by calling the GraphAPI and it works.

Here's how the the body looks for the creation of a user:

        const user = {
            displayName: name,
            identities: [
                {
                    signInType: "userName",
                    issuer: `${this.TENANT_NAME}`,
                    issuerAssignedId: name,
                },
                {
                    signInType: "emailAddress",
                    issuer: `${this.TENANT_NAME}`,
                    issuerAssignedId: email,
                },
            ],
            userPrincipalName: `${secret}@${this.TENANT_NAME}`,
            mail: email,
            passwordProfile: {
                password: password,
                forceChangePasswordNextSignIn: false,
            },
            passwordPolicies: "DisablePasswordExpiration",
        };

Note: The above code works when I do the normal email sign up process where the user sets their own password.

Now I am trying to create one using the information I've gotten from Microsoft SSO. Now, I thought that I should just remove the passwordProfile and passwordPolicies but that doesn't work and I get a 400: Bad Request on the Graph API.

I've tried changing the user object to this:

        const user = {
            displayName: name,
            identities: [
                {
                    signInType: "userName",
                    issuer: `${this.TENANT_NAME}`,
                    issuerAssignedId: name,
                },
                {
                    signInType: "emailAddress",
                    issuer: `${this.TENANT_NAME}`,
                    issuerAssignedId: email,
                },
            ],
            userPrincipalName: `${secret}@${this.TENANT_NAME}`,
            mail: email,
            accountEnabled: true, //removed passwordProfile and passwordPolicies and put accountEnabled: true
        };

and this just gives me a 400: Bad Request. The error doesn't contain much information either.

Perhaps I am missing something here. Do I need to do something with the policy/permissions or something here? From the Microsoft SSO response, I have the email, oid, and the name.

I have 2 questions here:

1. How do I create a user in my azure AD B2C with Graph API given that my user's info is being fetched from Microsoft SSO and hence, does not have a password?

2. How do I reconcile the azureId that I get after the creation of a user from the graph API and the oid I get from Microsoft SSO of the already created account?

For Graph API, I get my access token like this:

    async getAccessToken(): Promise<any> {
        try {
            const response = await this.CREDENTIAL.getToken(
                "https://graph.microsoft.com/.default"
            );



            return response.token;
        } catch (error) {
            console.error("Error obtaining access token:", error);
        }
    }

And then use it to call the graph API like this:

            const response = await axios.post(
                "https://graph.microsoft.com/v1.0/users",
                user,
                {
                    headers: {
                        Authorization: `Bearer ${accessToken}`,
                        "Content-Type": "application/json",
                    },
                }
            );
            console.log(response.data);
            return response.data;

The solution for this was to pass the user object like this:

        const user = {
            displayName: name,
            identities: [
                {
                    signInType: "federated",
                    issuer: `microsoft.com`,
                    issuerAssignedId: email,
                },
            ],
            userPrincipalName: `name ${secret}`,
            mail: email,
            accountEnabled: true,
        };

Important thing was that the signInType was federated and the issuer was set accordingly to microsoft.com as well. This way, password is not required and can make a user directly via GraphAPI.

This worked for me.

Note that: Password must be passed to create a new user in Azure AD B2C tenant.

• If the passwordProfile, isn't passed then you might end up with the error:

POST https://graph.microsoft.com/v1.0/users

{
"displayName": "user@xxx.onmicrosoft.com",
"identities": [
{
"signInType": "userName",
"issuer": "b2c.onmicrosoft.com",
"issuerAssignedId": "user"
},
{
"signInType": "emailAddress",
"issuer": "b2c.onmicrosoft.com",
"issuerAssignedId": "user@b2c.onmicrosoft.com"
}
],
"userPrincipalName": "user@xxx.onmicrosoft.com",
"mail": "user@xxx.onmicrosoft.com",
"accountEnabled": true
}

Hence to create a new user in Azure AD B2C you have to pass passwordProfile mandatory.

Hence make use of the code as mentioned by you:

const user = {
            displayName: name,
            identities: [
                {
                    signInType: "userName",
                    issuer: `${this.TENANT_NAME}`,
                    issuerAssignedId: name,
                },
                {
                    signInType: "emailAddress",
                    issuer: `${this.TENANT_NAME}`,
                    issuerAssignedId: email,
                },
            ],
            userPrincipalName: `${secret}@${this.TENANT_NAME}`,
            mail: email,
            passwordProfile: {
                password: password,
                forceChangePasswordNextSignIn: false,
            },
            passwordPolicies: "DisablePasswordExpiration",
        };

When you create a user in Azure AD B2C via the Microsoft Graph API, the * the id field in the API response and the oid from the SSO response are distinct but related values.

• The oid from Microsoft SSO is the unique identifier of the user within Azure AD or the federated identity provider and is used for sign-in or federation purposes.
• The oid from Microsoft SSO is the user's unique identifier in the external identity provider and you cannot pass this oid to create user in Azure AD B2C tenant.
• The id from Graph API response is the Azure AD object ID that uniquely identifies the user within your Azure AD B2C tenant.

When you pass the oid from Microsoft SSO in the Microsoft Graph API request you will get 400 bad request as the user is not present in the Azure AD B2C tenant.

Hence to perform any operations against the user, you have to pass id from Graph API response or id from the Azure AD B2C portal user blade not the oid from Microsoft SSO.