Is it a good way to use several Azure AD B2C?

Sanya Anishchik 41 Reputation points
2021-12-28T11:05:15.64+00:00

We have a product that contains next parts : Admin portal, desktop POS, Azure Function API. We manage users via Azure AD B2C and have authorization in POS and Functions via AD B2C. Everything works as expected.
But now we adding new applications - CRM and Mobile reports. And customers want to separate tech users (admin, pos/cloud app auth) from end users (crm, mobile). Is it good way to create two separate Azure AD B2C tenant to have two user stores? If yes, what if user from mobile want to call Function API that setup for another tenant?

Azure Functions
Azure Functions
An Azure service that provides an event-driven serverless compute platform.
4,211 questions
Microsoft Entra External ID
Microsoft Entra External ID
A modern identity solution for securing access to customer, citizen and partner-facing apps and services. It is the converged platform of Azure AD External Identities B2B and B2C. Replaces Azure Active Directory External Identities.
2,633 questions
Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
19,389 questions
0 comments
Accepted answer
  1. AmanpreetSingh-MSFT 56,301 Reputation points
    2021-12-29T08:06:50.077+00:00

    Hi @Sanya Anishchik • Thank you for reaching out.

    If users from mobile want to call Function API, I don't think it is a good idea to create 2 different Azure AD B2C tenants because users in tenant1 won't be able to access applications in tenant2. In that case, you would either be required to add applications to tenant1 as well or provision/signup the users in tenant2. Which will eventually defeat the purpose of having 2 different user stores with access to their respective applications.

    I would suggest you use the same tenant for both types of users and create a custom attribute e.g. employeeType and set the value of this attribute to Admin for administrators and User for end users. Your application should then perform authorization based on the value of this attribute to allow or deny access.

    -----------------------------------------------------------------------------------------------------------

    Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

    1 person found this answer helpful.

0 additional answers

Sort by: Most helpful
Most helpful Newest Oldest