AAD B2C - "Lag" after custom policy upload

Question

Hi everyone,

when I upload a new version of a custom policy it takes a varying amount of time (from a few seconds to five minutes) until the new version is used. During development this is very frustrating and time-consuming since I either have to wait five minutes to be sure (which breaks the workflow) or I have to initiate the policy several times until I get the updated version. And if it was only a slight policy update I have to add some noticable "versioning" to figure out whether the change was applied or not. This wastes a lot of time and makes the development of B2C policies very cumbersome. I found a similar question which was posted a year ago: https://stackoverflow.com/questions/69321812/lag-in-getting-the-new-value-of-a-custom-attribute-after-updating-it

Is there still nothing that can be done about this? Either a flushing of policy caches or an indication on Azure Portal (of when the new policy is available) would be acceptable. But the current situation is very annoying.

Answer 1

The TTL of 15 minutes can be bypassed by setting DeploymentMode to "Development":

<TrustFrameworkPolicy xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xmlns:xsd="http://www.w3.org/2001/XMLSchema"
    xmlns="http://schemas.microsoft.com/online/cpim/schemas/2013/06" PolicySchemaVersion="0.3.0.0"
    TenantId="yourtenant.onmicrosoft.com"
    PolicyId="B2C_1A_YourPolicy"
    PublicPolicyUri="http://yourtenant.onmicrosoft.com/B2C_1A_YourPolicy"
    DeploymentMode="Development">

Answer 2

I have been experiencing the same issues but already had been using DeploymentMode=Development and I am still experiencing the ~15 minute lag. So I am not convinced the last comment is accurate.

Update: Although I have just realised I only have that setting on the top level Relying Party file :(

I will update the others and try again

Answer 3

This is really becoming a pain to do custom policy development. They should allow users to disable cache al together. We all know the benefit of caching so it's upto the users to keep it disabled in lower environment where as enable it in PROD.

Answer 4

I had a similar expirience. It's horrible.
Deleted policies are also still there for a long time..
Make sure your policy is correct, in case of incorrectness b2c behave realy strange - it seems like it picks an old one that worked. But you can't be sure it's the last one.
My only helper is to change a string message in the policy (version increment) to really make sure it's the one I think it's using.

Answer 5

Hi @Maximilian Bürgi ,

Thanks for your post! As Jas Suri mentioned, this appears to be part of the internal design due to replication delay in the regionally replicated domain controller infrastructure.

That said, I have created an internal work item based on your feedback to address this issue and improve the performance. If you provide more details about your scenario it will help in providing a business justification and adding details to the work item.

I have reached out internally to see if there are any updates about steps that can be taken to mitigate the issue, and will share the team's response as well.

In the meantime you are also welcome to create your own feedback in the Ideas portal where the product team can directly reply. https://feedback.azure.com/

-

If the information was helpful to you, please Accept the answer. This will help us and other community members as well.