Azure b2c Custom policy - Sign up but block user until manual verification

Question

It is possible to register as a user, but who does not have access to sign in until manually authorized by the web application administrator.

If it is possible, how can i do it?

Thanks for your help.

Regards :)

Answer 1

We do something similar. As far as Azure is concerned, you're authenticated once you log in. I don't know that I would mess with that but you probably could. Instead I would recommend that you add a separate property to the profile that you look at. It really depends on how much data (if any) you're storing in the Azure profile and how much you have outside of Azure.

If you are using Azure for the full authentication process and don't have an external system/database you need to pull data from then add a property to the user's profile in B2C that indicates they are "verified". When the user authenticates check for this property and if it hasn't been set yet then your app can display a somewhat meaningful message (e.g. "You have not yet been verified"). This is probably clearer to the user than a simple "not authorized" message as they are authorized, just not verified.

In your manual verification process, once the user has been verified, you can update the Azure profile property to set it to verified. Whether this is a manual process using the B2C UI or an automated call from your verification system is up to you.