Default user flow is picking up Pre-Created B2C users but Custom Policy is not

Question

I have a B2C tenant, where I have both, custom Policies and Default User-flows. I have both, local and federated user login setup for both of them.
Now I pre-create the federated users into the B2C, via MS GraphAPI, I give a payload which looks like this

{ 
    "accountEnabled": true,
    "displayName": "{{name}}",
    "givenName": "{{givenName}}",
    "surname": "{{surname}}",
    "mail": "{{email}}",
    "mailNickname": "{{mailNickname}}",
    "userPrincipalName": "{{uuid}}@{{tenantEmail}}",
    "identities": [
      {
        "signInType": "federated",
        "issuer": "{{issuer}}",
        "issuerAssignedId": "{{issuerAssignedId}}"
      }
    ]
}

The default user-flows easily pick this user up when run it. It authenticates them just fine and returns me the claims which include details of that user which I had created in B2C

But for some reason, my Custom Policy doesn't automatically pick the user up when i'm trying to authenticate it. Instead, it gives me this error:

AADB2C99002: This user does not exist and profile 'AAD-UserReadUsingAlternativeSecurityId-NoError' requires the user to have already been created. Correlation ID: ae62678a-3459-47d1-ae3d-ef65cbd7e18e Timestamp: 2025-02-13 14:21:04Z

Note that I've set:

<Item Key="RaiseErrorIfClaimsPrincipalDoesNotExist">true</Item>

I have verified that the issuer and issuerAssignedId are being passed correctly. Are custom policies supposed to pick such pre-created B2C users up automatically? Or does it need to have the alternative security id? Because my customer policy finds the user in this manner:

        <!-- For social IDP authentication, attempt to find the user account in the directory. -->
        <OrchestrationStep Order="6" Type="ClaimsExchange">
          <Preconditions>
            <Precondition Type="ClaimEquals" ExecuteActionsIf="true">
              <Value>authenticationSource</Value>
              <Value>localAccountAuthentication</Value>
              <Action>SkipThisOrchestrationStep</Action>
            </Precondition>
          </Preconditions>
          <ClaimsExchanges>
            <ClaimsExchange Id="AADUserReadUsingAlternativeSecurityId" TechnicalProfileReferenceId="AAD-UserReadUsingAlternativeSecurityId-NoError" />
          </ClaimsExchanges>
        </OrchestrationStep>

Answer 1

Hi @Hamza Khalid
Thank you for reaching Microsoft Q&A Forum!
Based on your requirement, I understand that the issue has occured due to claims exchange where you have choosen AAD-UserReadUsingAlternativeSecurityId which actually look up for a social directory. Whereas AAD-UserReadUsingObjectId picks both local or social account which helps in your scenario to pick the pre created Azure AD B2C users.

Please try the below technical profile in your custom policy and if you are able to pick pre-created B2C users up automatically.

<!-- For social IDP authentication, attempt to find the user account in the directory. -->
<OrchestrationStep Order="6" Type="ClaimsExchange">
<Preconditions>
<Precondition Type="ClaimEquals" ExecuteActionsIf="true">
<Value>authenticationSource</Value>
<Value>localAccountAuthentication</Value>
<Action>SkipThisOrchestrationStep</Action>
</Precondition>
</Preconditions>
<ClaimsExchanges>
<ClaimsExchange Id="AAD-UserReadUsingObjectId" TechnicalProfileReferenceId="AAD-UserReadUsingObjectId" />
</ClaimsExchanges>

You can refer below document for more details on AAD-Common technical profile: Microsoft Entra technical profile in an Azure Active Directory B2C custom policy

I hope this information is helpful. Please feel free to reach out if you have any further questions.