azure-active-directory-b2c

# Azure Active Directory B2C Skill This skill provides expert guidance for Azure Active Directory B2C. Covers troubleshooting, best practices, decision making, architecture & design patterns, limits & quotas, security, configuration, integrations & coding patterns, and deployment. It combines local quick-reference content with remote documentation fetching capabilities. ## How to Use This Skill > **IMPORTANT for Agent**: Use the **Category Index** below to locate relevant sections. For categories with line ranges (e.g., `L35-L120`), use `read_file` with the specified lines. For categories with file links (e.g., `[security.md](security.md)`), use `read_file` on the linked reference file > **IMPORTANT for Agent**: If `metadata.generated_at` is more than 3 months old, suggest the user pull the latest version from the repository. If `mcp_microsoftdocs` tools are not available, suggest the user install it: [Installation Guide](https://github.com/MicrosoftDocs/mcp/blob/main/README.md) This skill requires **network access** to fetch documentation content: - **Preferred**: Use `mcp_microsoftdocs:microsoft_docs_fetch` with query string `from=learn-agent-skill`. Returns Markdown. - **Fallback**: Use `fetch_webpage` with query string `from=learn-agent-skill&accept=text/markdown`. Returns Markdown. ## Category Index | Category | Lines | Description | |----------|-------|-------------| | Troubleshooting | L37-L43 | Diagnosing and fixing Azure AD B2C errors, debugging custom policies and user flows, and using Application Insights to trace and troubleshoot policy execution. | | Best Practices | L44-L52 | Best practices for configuring Azure AD B2C, designing user flows/custom policies, securing MFA and architecture, and detecting/mitigating credential and account attacks. | | Decision Making | L53-L60 | Guidance on planning Azure AD B2C usage: choosing app types, understanding MAU billing, regions/data residency, retirement impact, and selecting a user migration strategy. | | Architecture & Design Patterns | L61-L69 | Global Azure AD B2C customer identity architectures, comparing funnel- vs region-based designs, and step-by-step proof-of-concept implementations for each pattern | | Limits & Quotas | L70-L77 | Service limits, quotas, and restrictions for Azure AD B2C tenants, including directory size, token formats/constraints, and tenant creation and scaling limits. | | Security | L78-L94 | Security hardening for Azure AD B2C: MFA, Conditional Access, Identity Protection, CAPTCHA, TLS/ciphers, policy keys, admin/tenant access control, API security, and Sentinel-based monitoring. | | Configuration | L95-L209 | Configuring Azure AD B2C: custom policies, user flows, tokens, MFA, identity providers, claims/transformations, app/API registration, UI/localization, SSO, security, and advanced auth options. | | Integrations & Coding Patterns | L210-L322 | Patterns and step-by-step guides for integrating Azure AD B2C into apps, securing APIs, configuring IdPs/social logins, custom policies, fraud/risk tools, and routing logs/monitoring. | | Deployment | L323-L327 | Automating deployment of Azure AD B2C custom policies using CI/CD pipelines, including setup steps, YAML examples, and best practices for Azure Pipelines and GitHub Actions. | ### Troubleshooting | Topic | URL | |-------|-----| | Azure AD B2C error codes and troubleshooting reference | https://learn.microsoft.com/en-us/azure/active-directory-b2c/error-codes | | Troubleshoot Azure AD B2C custom policies and user flows | https://learn.microsoft.com/en-us/azure/active-directory-b2c/troubleshoot | | Troubleshoot Azure AD B2C custom policies with Application Insights | https://learn.microsoft.com/en-us/azure/active-directory-b2c/troubleshoot-with-application-insights | ### Best Practices | Topic | URL | |-------|-----| | Apply Azure AD B2C integration and configuration best practices | https://learn.microsoft.com/en-us/azure/active-directory-b2c/best-practices | | Developer guidance for Azure AD B2C user flows and custom policies | https://learn.microsoft.com/en-us/azure/active-directory-b2c/custom-policy-developer-notes | | Secure phone-based MFA in Azure AD B2C using monitoring and alerts | https://learn.microsoft.com/en-us/azure/active-directory-b2c/phone-based-mfa | | Apply security best practices to Azure AD B2C architecture | https://learn.microsoft.com/en-us/azure/active-directory-b2c/security-architecture | | Mitigate credential attacks in Azure AD B2C | https://learn.microsoft.com/en-us/azure/active-directory-b2c/threat-management | ### Decision Making | Topic | URL | |-------|-----| | Choose appropriate application types for Azure AD B2C | https://learn.microsoft.com/en-us/azure/active-directory-b2c/application-types | | Understand Azure AD B2C MAU billing and tier selection | https://learn.microsoft.com/en-us/azure/active-directory-b2c/billing | | Plan Azure AD B2C region availability and data residency | https://learn.microsoft.com/en-us/azure/active-directory-b2c/data-residency | | Choose a user migration approach to Azure AD B2C | https://learn.microsoft.com/en-us/azure/active-directory-b2c/user-migration | ### Architecture & Design Patterns | Topic | URL | |-------|-----| | Apply funnel-based global identity design with Azure AD B2C | https://learn.microsoft.com/en-us/azure/active-directory-b2c/b2c-global-identity-funnel-based-design | | Implement funnel-based global identity proof of concept in Azure AD B2C | https://learn.microsoft.com/en-us/azure/active-directory-b2c/b2c-global-identity-proof-of-concept-funnel | | Implement region-based global identity proof of concept in Azure AD B2C | https://learn.microsoft.com/en-us/azure/active-directory-b2c/b2c-global-identity-proof-of-concept-regional | | Apply region-based global identity design with Azure AD B2C | https://learn.microsoft.com/en-us/azure/active-directory-b2c/b2c-global-identity-region-based-design | | Design a global customer identity solution with Azure AD B2C | https://learn.microsoft.com/en-us/azure/active-directory-b2c/b2c-global-identity-solutions | ### Limits & Quotas | Topic | URL | |-------|-----| | Review Azure AD B2C service limits and restrictions | https://learn.microsoft.com/en-us/azure/active-directory-b2c/service-limits | | Monitor and manage Azure AD B2C directory size quota | https://learn.microsoft.com/en-us/azure/active-directory-b2c/tenant-management-directory-quota | | Understand Azure AD B2C token types, contents, and constraints | https://learn.microsoft.com/en-us/azure/active-directory-b2c/tokens-overview | | Create Azure AD B2C tenant and understand tenant limits | https://learn.microsoft.com/en-us/azure/active-directory-b2c/tutorial-create-tenant | ### Security | Topic | URL | |-------|-----| | Enable CAPTCHA protection in Azure AD B2C user flows and policies | https://learn.microsoft.com/en-us/azure/active-directory-b2c/add-captcha | | Use Identity Protection and Conditional Access with Azure AD B2C | https://learn.microsoft.com/en-us/azure/active-directory-b2c/conditional-access-identity-protection-overview | | Add Conditional Access and MFA to Azure AD B2C user flows | https://learn.microsoft.com/en-us/azure/active-directory-b2c/conditional-access-user-flow | | Configure Microsoft Sentinel analytics for Azure AD B2C logs | https://learn.microsoft.com/en-us/azure/active-directory-b2c/configure-security-analytics-sentinel | | Configure TLS and cipher suite requirements for Azure AD B2C endpoints | https://learn.microsoft.com/en-us/azure/active-directory-b2c/https-cipher-tls-requirements | | Investigate and remediate identity risk in Azure AD B2C | https://learn.microsoft.com/en-us/azure/active-directory-b2c/identity-protection-investigate-risk | | Enable and configure multifactor authentication in Azure AD B2C | https://learn.microsoft.com/en-us/azure/active-directory-b2c/multi-factor-authentication | | Manage Azure AD B2C policy keys for secure token signing | https://learn.microsoft.com/en-us/azure/active-directory-b2c/policy-keys-overview | | Assign Azure AD B2C roles for resource access control | https://learn.microsoft.com/en-us/azure/active-directory-b2c/roles-resource-access-control | | Secure REST APIs used by Azure AD B2C API connectors | https://learn.microsoft.com/en-us/azure/active-directory-b2c/secure-rest-api | | Control tenant creation permissions in Azure AD B2C | https://learn.microsoft.com/en-us/azure/active-directory-b2c/tenant-management-check-tenant-creation-permission | | Configure emergency access administrator accounts in Azure AD B2C | https://learn.microsoft.com/en-us/azure/active-directory-b2c/tenant-management-emergency-access-account | | Manage administrator accounts in Azure AD B2C tenants | https://learn.microsoft.com/en-us/azure/active-directory-b2c/tenant-management-manage-administrator | ### Configuration | Topic | URL | |-------|-----| | Configure SSPR technical profiles in Azure AD B2C custom policies | https://learn.microsoft.com/en-us/azure/active-directory-b2c/aad-sspr-technical-profile | | Configure Microsoft Entra technical profiles in Azure AD B2C | https://learn.microsoft.com/en-us/azure/active-directory-b2c/active-directory-technical-profile | | Add and configure API connectors in Azure AD B2C sign-up flows | https://learn.microsoft.com/en-us/azure/active-directory-b2c/add-api-connector | | Configure token enrichment with external APIs in Azure AD B2C | https://learn.microsoft.com/en-us/azure/active-directory-b2c/add-api-connector-token-enrichment | | Add external identity providers to Azure AD B2C tenant | https://learn.microsoft.com/en-us/azure/active-directory-b2c/add-identity-provider | | Add and configure native client apps in Azure AD B2C | https://learn.microsoft.com/en-us/azure/active-directory-b2c/add-native-application | | Configure Azure AD B2C custom policy for password change | https://learn.microsoft.com/en-us/azure/active-directory-b2c/add-password-change-policy | | Configure password reset user flows in Azure AD B2C | https://learn.microsoft.com/en-us/azure/active-directory-b2c/add-password-reset-policy | | Configure profile editing user flows in Azure AD B2C | https://learn.microsoft.com/en-us/azure/active-directory-b2c/add-profile-editing-policy | | Configure resource owner password credentials (ROPC) flow in Azure AD B2C | https://learn.microsoft.com/en-us/azure/active-directory-b2c/add-ropc-policy | | Configure sign-in-only user flows in Azure AD B2C | https://learn.microsoft.com/en-us/azure/active-directory-b2c/add-sign-in-policy | | Configure sign-up and sign-in user flows in Azure AD B2C | https://learn.microsoft.com/en-us/azure/active-directory-b2c/add-sign-up-and-sign-in-policy | | Register and expose a web API in Azure AD B2C | https://learn.microsoft.com/en-us/azure/active-directory-b2c/add-web-api-application | | Enable age gating policies in Azure AD B2C | https://learn.microsoft.com/en-us/azure/active-directory-b2c/age-gating | | Track Azure AD B2C user journeys with Application Insights | https://learn.microsoft.com/en-us/azure/active-directory-b2c/analytics-with-application-insights | | Migrate Azure AD B2C apps and APIs to b2clogin.com | https://learn.microsoft.com/en-us/azure/active-directory-b2c/b2clogin | | Use boolean claims transformations in Azure AD B2C policies | https://learn.microsoft.com/en-us/azure/active-directory-b2c/boolean-transformations | | Configure BuildingBlocks section in Azure AD B2C custom policies | https://learn.microsoft.com/en-us/azure/active-directory-b2c/buildingblocks | | Configure CAPTCHA technical profiles in Azure AD B2C custom policies | https://learn.microsoft.com/en-us/azure/active-directory-b2c/captcha-technical-profile | | Use claim resolvers in Azure AD B2C custom policies | https://learn.microsoft.com/en-us/azure/active-directory-b2c/claim-resolver-overview | | Define claims transformation technical profiles in Azure AD B2C | https://learn.microsoft.com/en-us/azure/active-directory-b2c/claims-transformation-technical-profile | | Configure ClaimsProvider elements in Azure AD B2C custom policies | https://learn.microsoft.com/en-us/azure/active-directory-b2c/claimsproviders | | Define ClaimsSchema and claim types in Azure AD B2C | https://learn.microsoft.com/en-us/azure/active-directory-b2c/claimsschema | | Configure ClaimsTransformations in Azure AD B2C custom policies | https://learn.microsoft.com/en-us/azure/active-directory-b2c/claimstransformations | | Configure OAuth 2.0 client credentials flow in Azure AD B2C | https://learn.microsoft.com/en-us/azure/active-directory-b2c/client-credentials-grant-flow | | Configure Conditional Access technical profiles in Azure AD B2C | https://learn.microsoft.com/en-us/azure/active-directory-b2c/conditional-access-technical-profile | | Configure Azure AD B2C authentication in Azure Web App via configuration file | https://learn.microsoft.com/en-us/azure/active-directory-b2c/configure-authentication-in-azure-web-app-file-based | | Configure token lifetimes and formats in Azure AD B2C | https://learn.microsoft.com/en-us/azure/active-directory-b2c/configure-tokens | | Configure user attributes and input fields in Azure AD B2C journeys | https://learn.microsoft.com/en-us/azure/active-directory-b2c/configure-user-input | | Configure ContentDefinitions in Azure AD B2C custom policies | https://learn.microsoft.com/en-us/azure/active-directory-b2c/contentdefinitions | | Understand Azure AD B2C cookie definitions and behavior | https://learn.microsoft.com/en-us/azure/active-directory-b2c/cookie-definitions | | Enable and configure custom domains in Azure AD B2C | https://learn.microsoft.com/en-us/azure/active-directory-b2c/custom-domain | | Create and deploy a basic Azure AD B2C custom policy | https://learn.microsoft.com/en-us/azure/active-directory-b2c/custom-policies-series-hello-world | | Validate Azure AD B2C custom policies with VS Code schema | https://learn.microsoft.com/en-us/azure/active-directory-b2c/custom-policies-series-install-xml-extensions | | Configure Azure AD B2C custom policies with Identity Experience Framework | https://learn.microsoft.com/en-us/azure/active-directory-b2c/custom-policy-overview | | Configure single sign-on session providers in Azure AD B2C custom policies | https://learn.microsoft.com/en-us/azure/active-directory-b2c/custom-policy-reference-sso | | Customize Azure AD B2C user interface branding | https://learn.microsoft.com/en-us/azure/active-directory-b2c/customize-ui | | Use date claims transformations in Azure AD B2C policies | https://learn.microsoft.com/en-us/azure/active-directory-b2c/date-transformations | | Set up direct sign-in and prefilled usernames in Azure AD B2C | https://learn.microsoft.com/en-us/azure/active-directory-b2c/direct-signin | | Disable email verification during Azure AD B2C sign-up | https://learn.microsoft.com/en-us/azure/active-directory-b2c/disable-email-verification | | Configure CAPTCHA display controls in Azure AD B2C custom policies | https://learn.microsoft.com/en-us/azure/active-directory-b2c/display-control-captcha | | Configure TOTP display controls for MFA in Azure AD B2C | https://learn.microsoft.com/en-us/azure/active-directory-b2c/display-control-time-based-one-time-password | | Configure verification display controls for claims in Azure AD B2C | https://learn.microsoft.com/en-us/azure/active-directory-b2c/display-control-verification | | Configure display controls in Azure AD B2C custom policies | https://learn.microsoft.com/en-us/azure/active-directory-b2c/display-controls | | Configure advanced Android authentication options in Azure AD B2C | https://learn.microsoft.com/en-us/azure/active-directory-b2c/enable-authentication-android-app-options | | Configure advanced authentication options for Angular SPAs with Azure AD B2C | https://learn.microsoft.com/en-us/azure/active-directory-b2c/enable-authentication-angular-spa-app-options |