Does Azure AD B2C support IdP initiated flow while using external IdP?

Question

We are using Azure AD B2C as SP in case of SAML integration with our clients. As in this case our clients being the external IdPs. So, with this setup we have requirement for below flows:

1. SP initiated flow.
2. IdP initiated flow.

And we have successfully integrated with couple of external IdPs(salesforce and Auth0 by Okta) using this document in our test environments, we're able to successfully login into our application using SP initiated flow. Now, we're wondering how to achieve the IdP initiated flow with our external IdPs and we don't seem to find correct way to achieve.

Ran into this article https://learn.microsoft.com/en-us/azure/active-directory-b2c/saml-service-provider-options?pivots=b2c-custom-policy#configure-idp-initiated-flow where it says Azure AD B2C doesn't support IdP initiated flow while B2C acting as SP? Is that correct understanding? Please clarify.

Thanks

Answer 1

@Jagath Indupuru

Thank you for posting your query on Microsoft Q&A. Yes, currently IdP-initiated flow is supported only for local account authentication in Azure AD B2C.

It supports SP initiated flow where SAML assertion response is provided by B2C only when requested by application(SP), but not IDP flow as It would requires B2C to issue SAML response when requested by federated IDP (which involves risk of SAML Auth request to be stolen / tampered ).

However if you feel this is impacting the business needs. Kindly post you request on our Feedback portal as this is monitored by our service engineering group or you may raise a feature request via a support case.

Please do let me know if you have any further queries on this in the comments section.

Thanks

Akshay Kaushik

Please "Accept the answer" (Yes/No), and share your feedback if the you feel I was able to answer your query. This will help us and others in the community as well.