We're using the built-in form based authentication for Dynamics 365 portals. Portal users/contacts get email invite, having the invitation code. My invitation workflow (customized the default) also assign web role to this user and also assign him to an account.
We want to move to Azure B2C and also using the same process like creating invite email for the portal users. How can this be achieved.
Would really appreciate.
Go into Azure > Subscriptions > [Your Subscription] > Settings > Resource Providers > Microsoft.AzureActiveDirectory > Register (otherwise creating B2C will give you an error).
Step 1: Create a new Azure AD B2C Tenant
Step 2: Link an existing Azure AD B2C Tentant to my Azure Subscription
Register Azure B2C to work with Customer Portal
Automatic configuration is no longer a thing. The documentation is out of date, even though it says it was updated recently.
NOTE that this procedure is not quite straightforward. There are some things that you will need to change. For example, it says you need to check just the ID Tokens box, but you should also check the Access Tokens box or the Customer Portal will tell you that Azure B2C Sign in Failed because Implicit Authentication is not allowed.
Create user flows for sign-up / sign-in and password resets under Home > Azure AD B2C > Policies > User Flows
If you wanted to collect info during sign up, you would do it in the signup / signin flow.
Change the token compatibility settings to the second version (Azure AD B2C > Your flow > Properties > Token Compatibility Settings > Issuer (iss) claim
Azure will authenticate to this address:
If you want to add an address, do it in the B2C settings by adding an extra URI to authenticate to.
Here were my final settings upon configuration of Azure B2C with the TEST customer portal:
Registration enabled = false. That way, people can only register for the portal if there is an existing contact in our system for them.
External logout = false so it would keep them on the portal page once they sign out, instead of redirecting them to the external Azure B2C signout page.
Contact mapping with email = true means the contacts will be mapped to their unique email.
REMEMBER TO SET IT AS DEFAULT
ALSO, when you make changes to the authentication settings in the portal, you have to restart the portal (Portal Settings > Administration > Portal Actions > Restart) for them to take effect effectively. Otherwise you'll be left wondering a few hours in the future why your changes didn't apply.
Customizing the sign in pages to look nice:
Go into the Azure B2C User Flows settings, select the flow, and go to Customize > Page Layouts. Here you can customize things. https://docs.microsoft.com/en-us/azure/active-directory-b2c/customize-ui-with-html?pivots=b2c-user-f...
FYI if you got through all of this, there are still a bunch of things left to configure but this post will get extremely long, so I'll leave it for next time.
Also wanted to add that if you have Azure B2C set as default and have your invitations configured, then the invitation code will automatically redirect to Azure B2C. However if you have an existing contact you're sending an invitation for, the "sign up" flow will fail because the contact already exists. The way to bypass this is by using the "Password Reset" flow instead of the "sign up" flow. Just edit the HTML / CSS of the Password Reset page to make it look like a sign up page.
Glad I can save someone some time, I sure spent quite a bit of my time when I first tried to configure Azure B2C. The documentation is fragmented and there isn't really a consolidated step by step document I could find.
Thanks for this, super helpful. Still having trouble with the sign up aspect though, seems like something is off when I try to signup it doesnt work. Is there something more to do with the mapping or if I have a contact in my Azure DB the emails automatically match? any help or resources would be appreciated!
You may need to clarify what you mean by "doesn't work". Some possibilities:
Thanks for the quick response! Ive tried all the things you mentioned (definitely took off the email verification at one point bc Ive run out of emails to test signup with). In the end the errors im getting are 'Registration Disabled' and 'Invalid Sign in Attempt'. I am also trying something a bit simpler in not having the invitation aspect at all, rather, anybody whos email is in my DB as a contact should be able to create an account. Is this a problem? I also tried to run the change pw flow which gives the same error.
Oh, one thing I forgot to mention is that Azure B2C does not accept email addresses that are not mainstream. (Anything that's not Google, Microsoft, Yahoo, etc... won't work.)
Learn how to create your own user groups today!
Check out the new Power Platform Community Connections gallery!
Join us, in-person, December 7–9 in Las Vegas, for the largest gathering of the Microsoft community in the world.