Exceptions and errors in B2C when using custom policies are logged using Application Insights.

As I have encountered exceptions, I have documented how I have searched for the actual cause.

Note that these are the error messages displayed in the browser.

I will keep adding cases to this post as…

By proofing up, I mean enabling MFA on the user’s login.

I’ve been involved with a number of companies who have gone through this exercise. Every one has had problems. Users don’t read the instructions and get confused. Support has to get involved.

The instructions say:

“Do this on your…

There are a lot of custom policy samples scattered all over the Internet so I thought I would try and collate them in one place

Invariably, the links will change and break. Please report these in the comments. Also, please report any others that you think should be added.

I…

PKCE (Proof Key for Code Exchange) is described here.

From the official OAuth 2.0 spec for PKCE:

“PKCE (RFC 7636) is an extension to the Authorization Code flow to prevent several attacks and to be able to securely perform the OAuth exchange from public clients.”

This is particularly useful for…

There’s a write up here on using .NET Core to access the B2C Graph API.

It gives you the following commands:

Command  Description
====================
[1]      Get all users (one page)
[2]      Get user by object ID
[3]      Get…

There is reference code for the SCIM endpoint here and a Wiki here.

“SCIM is a standardized definition of two endpoints — a /Users endpoint and a /Groups endpoint. Using common REST verbs to create, update, and delete objects, and a pre-defined schema for common attributes like group name, username…

Note: This is a PoC that you should use as a guide. The code is not Production ready and you use it at your own risk.

A number of people have asked me if B2C can use another repository for authentication e.g. …

There’s a gotcha with this when you use “ClaimEquals” with B2C custom policies.

Assume you have a claim that you read from B2C e.g. extension_ClaimInB2C and the user types some text into a TextBox e.g. ClaimFromTB and you want to compare the two in a user journey.

Both are defined…