azureazure-ad-b2cmicrosoft-entra-external-id

Is there a way of connect Entra External Id to our Azure B2C federation without using b2c login flow

We have a partner that going to provide a mobile client and Api layer and also there own Microsoft Entra External ID server. That is fine and a good solution. They can solve how the mobile app will login with Entra External ID, but we have in our business system the users within Azure B2C. I have done some reading and it does seems like we can use Entra´s Custom Extensions to get custom claims from B2C. But when it comes to Authentication and federation we would like Entra to have its own user flow since (not using B2C flows) mobile app is totally different than business system.

Do anybody know or have experience of conencting these two in a federation context?

Solution

  • Adding third-party OIDC connections to Entra External ID is now in public preview.

    The documentation is here.

    The B2C-specific documentation is here.

    In External ID, add the B2C connection under “External Identities”.

    enter image description here

    Set up the basics of the OIDC connection:

    enter image description here

    The “well-known endpoint” is:

    https://b2ctenant.b2clogin.com/b2ctenant.onmicrosoft.com/ B2C_1A_signup_signin_OIDC/v2.0/.well-known/openid-configuration

    where “B2C_1A_signup_signin_OIDC” is the SUSI custom policy you created above.

    Configure the B2C side as per the links above.

    Add this provider to an External ID user flow, and then when you run it, you will see:

    enter image description here

    I have described the above flow in a post on my blog as well.