Authentication and User Management Challenges in Azure B2C

Question

1- We are facing issues logging in users from our Azure B2C instance. We have created two user flows to handle authentication. However, we have encountered several issues after the user completes the sign-in process. Specifically, when a user signs in for the first time, an OTP is required to register them on the Community Training Platform. This poses a problem, as many of our users do not have access to a phone or email address. Ideally, we would like single sign-on (SSO) from an identity provider to grant direct access to the platform without the additional OTP step.

2- Additionally, please investigate and address the sign-out functionality issue to ensure that user sessions are properly terminated upon signing out.

3- We would also like to explore the possibility of passing a SAML token or claim containing the email address, allowing the Client directory to authenticate users without requiring separate email validation.

4- Would it be technically feasible to map an email address as the username to the email field within the directory and pre-load a password, thereby bypassing the need for email validation? Additionally, does Azure B2C support this approach?

Answer

Hello Sohail Dhoda,

Thanks for posting your question in the Microsoft Q&A forum.

Azure Active Directory B2C (Azure AD B2C) is a powerful identity and access management service designed to handle authentication for customer-facing applications. However, implementing user flows and managing authentication requirements can present challenges, especially when dealing with users who lack access to email or phone for OTP (One-Time Password) verification.

The requirement for OTP during the first-time sign-in process can create barriers for users who lack access to email or phone. To address this, you can implement Single Sign-On (SSO) from an identity provider (IdP) to allow users to authenticate directly without additional OTP verification. Some useful links are as below:

Proper sign-out functionality is critical to ensure that user sessions are terminated securely. Azure AD B2C supports sign-out by invalidating the session and redirecting the user to a specified page. Some useful links are as below:

To streamline authentication, you can pass a SAML token or claim containing the user’s email address. This allows the client directory to authenticate users without requiring separate email validation. Some useful links to refer as below:

Mapping an email address as the username and pre-loading a password can simplify the authentication process and bypass the need for email validation. Azure AD B2C supports this approach, but it requires careful configuration.

https://learn.microsoft.com/en-us/azure/active-directory-b2c/microsoft-graph-operations

By leveraging Azure AD B2C’s capabilities, you can address the challenges of OTP verification, sign-out functionality, and seamless authentication. Implementing SSO with federated identity providers eliminates the need for OTP, while proper configuration of the sign-out endpoint ensures secure session termination. Passing SAML tokens or claims allows for seamless authentication, and mapping email addresses as usernames with pre-loaded passwords simplifies the user experience.

Please, let me know the response helped answer your question? If the above answer helped, please do not forget to "Accept Answer" as this may help other community members to refer the info if facing a similar issue. 🙂

Share via

Authentication and User Management Challenges in Azure B2C

1 answer

Your answer