Azure AD B2C one-time password with Rest API

Question

I'm trying to implement an authentication flow within a WhatsApp conversation with a CopilotStudio Bot. I've been searching but i couldn't find any documentation that includes a way to start this kind of flow using a Rest API. In WhatsApp i already have the user identified (Email, name) so i would like to use their email to generate a one-time password from Azure B2C that they can enter within the conversation to authenticate them.

I found this thread in Azure Docs with a similar question but aparently there is no api, is that correct?

Please let me now if there is any other alternative that could be used

Answer 1

Hello Francisco,

Welcome to Microsoft Q&A!

In your case, implementing an authentication flow in a WhatsApp conversation with a Copilot Studio Bot can be a bit tricky, especially since there isn't a direct REST API for generating one-time passwords (OTPs) from Azure B2C specifically for WhatsApp interactions.

However, you here are our current options:

1. You can configure your Copilot to use manual authentication with Azure B2C. This involves prompting users to enter their credentials (like an OTP) directly in the chat. However, this requires the user to have a pre-existing account with Azure B2C.
2. As Azure B2C doesn't provide a direct API for OTP generation in this context, you could create a custom backend service that accepts the user's email, generates an OTP (using a library like pyotp for Python), sends the OTP to the user's email and prompts the user to enter the OTP in the WhatsApp conversation for verification
3. You could set up an Azure Function that handles the OTP generation and validation. This function can be called from your Copilot when the user initiates the authentication process

In case you need it, here are the steps you can follow to implement the options mentioned:

1. User Identification: Since you already have the user's email and name, you can start the authentication flow by sending a message asking them to verify their identity.
2. Generate OTP: Call your custom backend or Azure Function to generate and send the OTP to the user's email.
3. User Input: Prompt the user to enter the OTP in the WhatsApp conversation.
4. Validate OTP: Once the user enters the OTP, validate it against your backend service.
5. Authentication Success: If the OTP is correct, you can proceed with the authenticated session in the conversation.

I hope the information provided was helpful, please let me know if you have any questions or concerns with the information provided. I will be waiting for your response.

Best regards,

Gao

---

If the answer is the right solution, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

I forgot to include the mentioned link: https://github.com/MicrosoftDocs/azure-docs/issues/119375