Roled based authorization in Azure AD B2C

Jorge Lopez 31 Reputation points
2022-10-20T13:17:49.017+00:00

I'm building and application SPA + API which allows my costumers to log in (not sign up, the admin will register new users manually). and I want to grant permissions to different endpoints based on Group permissions (or roles instead). I'm using Azure functions for the serverless API, and React for the SPA.

I manage to set up the authorization part with Azure active Directory B2C successfully, as it seems the right alternative to handle with external costumers. The MSAL for React is very straightforward, and there is also a useful tutorial to implement Role-Based Access Control using Groups in Azure AD. However it seems that this feature is only available in Azure AD (not in the AD B2C), according to this references: link1 link2. (And obviously I don't want to allow users in the registration process to choose their group like suggested in this last link).

So my questions are:

  1. There is any way to implement some kind of RBAC in Azure AD B2C?
  2. If not, use Azure AD instead (which does allow it) is advisable to manage with external costumers?
Microsoft Entra External ID
Microsoft Entra External ID
A modern identity solution for securing access to customer, citizen and partner-facing apps and services. It is the converged platform of Azure AD External Identities B2B and B2C. Replaces Azure Active Directory External Identities.
2,657 questions
Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
19,622 questions
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Marilee Turscak-MSFT 34,061 Reputation points Microsoft Employee
    2022-10-21T23:46:22.723+00:00

    Hi @Jorge Lopez ,

    As you correctly pointed out, you cannot use Role-based Authorization with Azure AD B2C as it uses the Identity Experience Framework to specify which attributes should be collected from the users during sign-up and which application claims will be returned in the token after successful authentication. In addition, since users are using social identities where they typically sign up and create the accounts, it would be difficult for the admin to add their accounts to the app assigning the roles to their identities.

    Any roles specified using the App Registration get applied and returned in the token only when the authenticated against standard Azure AD and not Azure AD B2C.

    The closest sample that matches your requirement would likely be the guide, How to secure a Web API built with ASP.NET Core using the Azure AD B2C. You would need to set it up to use Claims-based Authorization to determine whether the users should get access to the API based on attributes that are inserted for the users by the RESTful API Connector or set by using Graph API calls.

    There is a related thread here that discusses this option as well as a few other options to achieve a similar scenario.

    -

    If the information was useful, please Accept the answer. This will help us and other members of the community who may be researching similar questions.

    1 person found this answer helpful.