Paid Support: Guidance on Programmatically Migrating User from B2B to B2c with JUST federated account

Question

Paid Support: Guidance on Programmatically Migrating User from B2B to B2c with JUST federated account

Tim Anderson 60

We are trying to move our users from azure b2b to b2c with no need to re-sign-up (very important). All our users are either members of our existing entra AD or federated through gmail, etc. We are having issues programmatically creating federated accounts in our b2c for users from externalAD -> we cannot locate their original issuerID in our entra, and the b2c graph api will not allow us to create new accts that only have federated identities and NO local acct.

We have exhausted documentation from the Azure help site, etc. Please don't just google and paste unless it is exactly this scenario with an answer.

Sanoop M 1,470 Reputation points Microsoft External Staff

2025-03-12T20:08:25.9533333+00:00
Hello @Tim Anderson,

Thank you for posting your query on Microsoft Q&A.

I understand that you are trying to migrate users from Azure B2B to Azure B2C tenant and all the users are either members of your existing entra AD or federated through gmail, etc.

1.Could you please provide the error message screenshot when you are trying to programmatically create federated accounts in your Azure B2C tenant.

2.Could you please update us if you are following any documents to programmatically create federated accounts in your Azure AD B2C tenant.

For information about programmatically creating user accounts, see Manage Azure AD B2C user accounts with Microsoft Graph.

Steps to Locate the Original Issuer ID for Federated Users in Entra ID

You can locate the original Issuer ID or the Identity Provider (IdP) identifier for a federated user in Entra ID using the following methods:

Check User’s Authentication Source in Microsoft Entra ID

When a federated user logs in, Microsoft Entra ID records information about the identity provider that authenticated them. The original issuer ID corresponds to the identity provider (IdP) that federated the user.

Using Microsoft Graph API:

To find the original issuer for a federated user, you can use Microsoft Graph API to inspect the sign-in logs and user authentication methods.

Sign-In Logs: The sign-in logs contain details about the authentication method used (which includes the identity provider). The logs will include the Issuer or Identity Provider (which corresponds to the "original issuer").

You need to query the sign-in logs using Graph API.

Example API Request (GET Sign-ins): GET https://graph.microsoft.com/v1.0/auditLogs/signIns?$filter=userPrincipalName eq '{userPrincipalName}' Authorization: Bearer {access_token}

This will return sign-in events for the specified user. Look for the federatedIdentityIssuer field in the response, which represents the original issuer for federated users.

Example Response:

{

    "value": [

        {

            "id": "some-sign-in-id",

            "userId": "some-user-id",

            "userPrincipalName": "user@example.com",

            "federatedIdentityIssuer": "https://sts.windows.net/{tenant-id}/", // This is the original issuer

            "appDisplayName": "Some App",

            "ipAddress": "some-ip",

            "status": {

                "errorCode": 0,

                "failureReason": null

            },

            "createdDateTime": "2025-03-13T12:34:56Z"

        }

    ]

}
Alex Wong 0 Reputation points

2025-03-12T21:27:20.82+00:00

Here is a print of the error we are getting, and the basic structure of the user we are sending to the post request. We were essentially trying to copy over what graph gives back when looking up identities from our main tenant, but with our b2c tenant domain.

Your answer

Alex Wong 0 Reputation points

2025-03-12T21:27:20.82+00:00

Here is a print of the error we are getting, and the basic structure of the user we are sending to the post request. We were essentially trying to copy over what graph gives back when looking up identities from our main tenant, but with our b2c tenant domain.

Share via

Paid Support: Guidance on Programmatically Migrating User from B2B to B2c with JUST federated account

Your answer