Azure B2C Invitation

[noorahmad001]

Hi Folks

We're using the built-in form based authentication for Dynamics 365 portals. Portal users/contacts get email invite, having the invitation code. My invitation workflow (customized the default) also assign web role to this user and also assign him to an account.

We want to move to Azure B2C and also using the same process like creating invite email for the portal users. How can this be achieved.

Would really appreciate.

@OliverRodrigues @Fubar @OOlashyn 

[OkayGoogle]

Go into Azure > Subscriptions > [Your Subscription] > Settings > Resource Providers > Microsoft.AzureActiveDirectory > Register (otherwise creating B2C will give you an error).

1. Create a new Resource Group called BusinessToCustomer
2. Create a new resource: Azure Active Directory B2C

Step 1: Create a new Azure AD B2C Tenant

• Your company name
• yourcompanybtc.onmicrosoft.com
• Subscripton Name
• Your Resource Group (in my case, BusinessToCustomer)

Step 2: Link an existing Azure AD B2C Tentant to my Azure Subscription

• ONLY DO THIS if you did not specify a subscription / resource group when creating the resource

Step 3:

Register Azure B2C to work with Customer Portal

Automatic configuration is no longer a thing. The documentation is out of date, even though it says it was updated recently.

• Manual: https://docs.microsoft.com/en-us/powerapps/maker/portals/configure/configure-azure-ad-b2c-provider-m...

NOTE that this procedure is not quite straightforward. There are some things that you will need to change. For example, it says you need to check just the ID Tokens box, but you should also check the Access Tokens box or the Customer Portal will tell you that Azure B2C Sign in Failed because Implicit Authentication is not allowed.

Create user flows for sign-up / sign-in and password resets under Home > Azure AD B2C > Policies > User Flows

• Sign-up / sign-in https://docs.microsoft.com/en-us/azure/active-directory-b2c/tutorial-create-user-flows#create-a-sign...
• Password Reset https://docs.microsoft.com/en-us/azure/active-directory-b2c/tutorial-create-user-flows#create-a-pass...

If you wanted to collect info during sign up, you would do it in the signup / signin flow.

Change the token compatibility settings to the second version (Azure AD B2C > Your flow > Properties > Token Compatibility Settings > Issuer (iss) claim

Azure will authenticate to this address:

If you want to add an address, do it in the B2C settings by adding an extra URI to authenticate to.

Here were my final settings upon configuration of Azure B2C with the TEST customer portal:

Registration enabled = false. That way, people can only register for the portal if there is an existing contact in our system for them.

External logout = false so it would keep them on the portal page once they sign out, instead of redirecting them to the external Azure B2C signout page.

Contact mapping with email = true means the contacts will be mapped to their unique email.

REMEMBER TO SET IT AS DEFAULT

ALSO, when you make changes to the authentication settings in the portal, you have to restart the portal (Portal Settings > Administration > Portal Actions > Restart) for them to take effect effectively. Otherwise you'll be left wondering a few hours in the future why your changes didn't apply.

STEP 4:

Customizing the sign in pages to look nice:

Go into the Azure B2C User Flows settings, select the flow, and go to Customize > Page Layouts. Here you can customize things. https://docs.microsoft.com/en-us/azure/active-directory-b2c/customize-ui-with-html?pivots=b2c-user-f...

FYI if you got through all of this, there are still a bunch of things left to configure but this post will get extremely long, so I'll leave it for next time.

[OkayGoogle]

Also wanted to add that if you have Azure B2C set as default and have your invitations configured, then the invitation code will automatically redirect to Azure B2C. However if you have an existing contact you're sending an invitation for, the "sign up" flow will fail because the contact already exists. The way to bypass this is by using the "Password Reset" flow instead of the "sign up" flow. Just edit the HTML / CSS of the Password Reset page to make it look like a sign up page.

[NikitaP]

Great work! This needs to be a blog post 🙂

[OkayGoogle]

Glad I can save someone some time, I sure spent quite a bit of my time when I first tried to configure Azure B2C. The documentation is fragmented and there isn't really a consolidated step by step document I could find.

[Anonymous]

Thanks for this, super helpful. Still having trouble with the sign up aspect though, seems like something is off when I try to signup it doesnt work. Is there something more to do with the mapping or if I have a contact in my Azure DB the emails automatically match? any help or resources would be appreciated!

[OkayGoogle]

You may need to clarify what you mean by "doesn't work". Some possibilities:

• If you have an existing contact you're sending an invitation for, the "sign up" flow will fail because the contact already exists. The way to bypass this is by using the "Password Reset" flow instead of the "sign up" flow.
• If you mean that the email is not sending, you need to make sure that the portal is trying to send as the System Administrator.
• If you get a "Sign in failed" error, you may not have checked the "Email address" box in flow attributes and claims (Azure > B2C > Your sign up flow > User Attributes > Email Address; Azure > B2C > Your sign up flow > Application Claims >Email Address)
• Check your portal settings and try turning registration on (Portal > Site Settings > Active Site Settings > Authentication/Registration/Enabled, Authentication/Registration/ExternalLoginEnabled)
• You might need to add the base portal URL (https://yourportal.powerappsportals.com) into the Azure B2C authentication reply  URI properties (Azure > B2C > Your Portal > Authentication > Web Redirect URIs > Add URI)
• Double check that you checked both boxes: ID Tokens, Access Tokens when setting up Azure B2C (Azure > B2C> Your Portal > Authentication)

[Anonymous]

Thanks for the quick response! Ive tried all the things you mentioned (definitely took off the email verification at one point bc Ive run out of emails to test signup with). In the end the errors im getting are 'Registration Disabled' and 'Invalid Sign in Attempt'. I am also trying something a bit simpler in not having the invitation aspect at all, rather, anybody whos email is in my DB as a contact should be able to create an account. Is this a problem? I also tried to run the change pw flow which gives the same error.

[OkayGoogle]

Do you mean that you already have people as contacts in your portal before trying to sign them up?

[OkayGoogle]

Oh, one thing I forgot to mention is that Azure B2C does not accept email addresses that are not mainstream. (Anything that's not Google, Microsoft, Yahoo, etc... won't work.)