How to access an API registered in one AAD tenant (Tenant-A) from a public/native client app registered in another B2C Tenant (Tenant-B)

Varun 16 Reputation points
2020-11-10T05:14:15.577+00:00

Hi Everyone,

I followed the instructions mentioned in answer to this question to access a Web API registered in one AAD tenant (Tenant A) from another AAD tenant (Tenant B):

https://learn.microsoft.com/en-us/answers/questions/25329/how-to-access-an-api-registered-as-multi-tenantten.html

I tried the same process using an application registered in the B2C Tenant. I can see the service principal of the API being created in the B2C Tenant, I also added it as the permission for my B2C Application. But when I try to run my user flow, in the Access token section I do not see the API for this application.

I can provide the screenshots if required.

Any help is appreciated.

Thanks,
Varun

Microsoft Entra External ID
Microsoft Entra External ID
A modern identity solution for securing access to customer, citizen and partner-facing apps and services. It is the converged platform of Azure AD External Identities B2B and B2C. Replaces Azure Active Directory External Identities.
2,636 questions
Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
19,437 questions

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. AmanpreetSingh-MSFT 56,306 Reputation points
    2020-11-10T11:02:22.65+00:00

    Hello @Varun · Thank you for reaching out.

    This is expected. Under "Access token" section of User Flow, you will only see the applications which are registered directly under B2C tenant. However, you can manually update the "Run user flow endpoint" to include scope of Web API registered in Tenant A as mentioned below:

    https://your_tenant.b2clogin.com/your_tenant.onmicrosoft.com/oauth2/v2.0/authorize?p=B2C_1_SuSi&client_id=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx&nonce=defaultNonce&redirect_uri=https://jwt.ms&scope=https://tenantA.onmicrosoft.com/tenantA-api/read&response_type=token&prompt=login

    In the above example, I have copied "Run user flow endpoint" and updated below parameters:

    Redirect_uri : Where the token will be posted.
    Scope: Scopes exposed in the api registered in Tenant A. Multiple scopes can be added by using space as separator.
    Response_type: Set to token for getting Access token in response. Scopes are included only in Access token as SCP claim and not in id_token.

    -----------------------------------------------------------------------------------------------------------

    Please "Accept the answer" if the information helped you. This will help us and others in the community as well.