How to create users from another Tenant to B2C

Question

Hello,

I am currently working on implementing B2C login in my project. I have set up a user flow for signing in and added an Identity Provider using OpenID Connect, along with another option for local account login through B2C.

I have successfully created the necessary application in my tenant and configured it within the OpenID Connect provider. Additionally, I have created users in the B2C tenant who are part of the first tenant as ExternalAzureAD users. However, when I attempt to log in from the first tenant, I encounter the following error: "AADB2C99002: User does not exist. Please sign up before you can sign in."

I have assigned the user to both the first tenant and the B2C tenant for each application accordingly.

Could you please advise on how to resolve this issue?

Thank you.

Answer 1

Hi @Kevin Dule

Thank you for reaching us!

If understand correctly that you are trying to authenticate users from Entra ID tenant in Azure AD B2C tenant.
Let me explain your scenario, you have set up Azure AD B2C in company B's tenant to authenticate users from company A's Entra ID. The error "AADB2C99002: User does not exist. Please sign up before you can sign in" occurs when the user is not found in the Azure AD B2C directory.

To resolve this issue, you need to configure Azure AD B2C to use company A's Entra ID as an identity provider. This way, users from company A can authenticate using their Entra ID credentials, and Azure AD B2C will not look for them in company B's directory. Here are the steps to configure Entra ID as an identity provider in Azure AD B2C:

• Register an application in company A's Entra ID tenant.

Record the Application (client) ID and create a client secret for the registered application.

In company B's Azure AD B2C tenant, create a policy key to store the client secret.

• Configure Azure AD B2C to use company A's Entra ID as an identity provider by adding it to the ClaimsProvider element in the extension file of your policy. After configuring Azure AD as an identity provider, you should be able to authenticate users from company A in the Web App deployed in Azure from company B using Azure AD B2C.

If the issue persisted pleas do refer the below threads which is similar to your issue.
https://learn.microsoft.com/en-us/answers/questions/891744/azure-ad-b2c-sign-in-workflow-with-google-as-an-id
https://learn.microsoft.com/en-us/answers/questions/255659/how-can-i-invite-guest-users-to-azure-b2c-platform
https://learn.microsoft.com/en-us/answers/questions/1339286/how-to-add-a-federated-user-that-can-be-authentica

Hope this helps. Do let us know if you any further queries by responding in the comments section.

Thanks,

Akhilesh.

---

If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.

Answer 2

Hi @Kevin Dule

I'm glad that you were able to resolve your issue and thank you for posting your solution so that others experiencing the same thing can easily reference this! Since the Microsoft Q&A community has a policy that "The question author cannot accept their own answer. They can only accept answers by others ", I'll repost your solution in case you'd like to "Accept " the answer.

Issue:

when you attempt to log in from the first tenant, you encounter the following error: "AADB2C99002: User does not exist. Please sign up before you can sign in."

Solution:

To fix this issue you have prepared a script using Microsoft Graph. Users from Tenant A should be created also in Tenant B2C. So, you have defined these identities for these users

If you have any other questions or are still running into more issues, please let me know. Thank you again for your time and patience throughout this issue.

Please remember to "Accept Answer" if any answer/reply helped, so that others in the community facing similar issues can easily find the solution.

Answer 3

Hello,

I am attaching Powershell Script for creating users from another Tenant. This script will solve the error "AADB2C99002: User does not exist. Please sign up before you can sign in."

$Tenant1ID = "your-tenant-id"
$B2CTenantID = "your-b2c-tenant-id"
$listOfUsers = @("user1@example.com")

Write-host "Connecting to Tenant 1: " -ForegroundColor Yellow -NoNewline
Connect-MgGraph -TenantId $Tenant1ID -Scopes user.read.all -NoWelcome -ErrorAction SilentlyContinue

if((Get-MgContext).TenantId -eq $Tenant1ID) {
    Write-host "Done.`r`n" -ForegroundColor Green
    $users = @()
    Write-host "Retrieving users from Tenant 1:" -ForegroundColor Yellow
    foreach($user in $listOfUsers) {
        $tenantUser = Get-MgUser -UserId $user -Property id,displayname,surname,givenname,mail -ErrorAction SilentlyContinue
        if($tenantUser) {
            Write-Host "`tUser retrieved: $user" -ForegroundColor Green
            $users += @($tenantUser)
        }
        else {
            Write-Host "`tUser not found: $user" -ForegroundColor Red
        }
    }
    
    Write-host "`r`n`r`nConnecting to B2C tenant: " -ForegroundColor Yellow -NoNewline
    Connect-MgGraph -TenantId $B2CTenantID -Scopes user.readwrite.all -NoWelcome -ErrorAction SilentlyContinue

    if((Get-MgContext).TenantId -eq $B2CTenantID) {
        Write-host "Done.`r`n" -ForegroundColor Green
        Write-host "Provisioning users:" -ForegroundColor Yellow
        
        foreach($user in $users) {
            Write-Host "`tWorking on $($user.displayName)[$($user.id)]: " -ForegroundColor Yellow -NoNewline
            $params = @{
                displayName = $user.displayName
                identities = @(
                    @{
                        signInType = "userPrincipalName"
                        issuer = "your-b2c-domain.onmicrosoft.com"
                        issuerAssignedId = "cpim_$($user.id)@your-b2c-domain.onmicrosoft.com"
                    }
                    @{
                        signInType = "federated"
                        issuer = "https://login.microsoftonline.com/$($Tenant1ID)/v2.0"
                        issuerAssignedId = $user.id
                    }
                )
                passwordProfile = @{
                    forceChangePasswordNextSignIn = $false
                }
                passwordPolicies = "DisablePasswordExpiration"
                AccountEnabled = $false
            }

            if($user.GivenName) {
                $params.Add("GivenName", $user.GivenName)
            }
            if($user.Surname) {
                $params.Add("Surname", $user.Surname)
            }
            
            $newUser = New-MgUser -BodyParameter $params
            if($newUser) {
                Write-host "Done." -ForegroundColor Green
            }
            else {
                Write-host "Failed." -ForegroundColor Red
            }
        }
    }
    else {
        Write-Host "Unable to connect to B2C tenant." -ForegroundColor Red
    }
}
else {
    Write-Host "Unable to connect to Tenant 1." -ForegroundColor Red
}