Does Azure B2C support any corporate Azure AD as IdP?

Question

We want to add Azure AD as an IdP, in Azure B2C, using the URL below in order to allow any tenant, but it is not allowed in the dialog.

https://login.microsoftonline.com/common/v2.0/.well-known/openid-configuration

We have also tried with organizations instead of common, as below, which is accepted in the dialog, but then we get issues is not valid in the response.

https://login.microsoftonline.com/organizations/v2.0/.well-known/openid-configuration

If we add a specific tenant id instead of common in the URL, it all works fine, but we must be able to allow any Azure AD tenant to sign in.

Is this not supported using Azure AD B2C?

We have configured the app registration used to allow the following...

Accounts in any identity provider or organizational directory (for authenticating users with user flows)

This is the most common option for apps that are exposed to your customers. You must select this option to authenticate users with Azure AD B2C user flows. This option enables you to target local accounts and the widest set of user identities from Microsoft, Facebook, Google, Twitter, or any OpenID Connect provider.

Answer 1

@Joel Fjordén

Thank your for posting your query on Microsoft Q&A.

From the above I am able to conclude that you want to add Azure AD as an IDP in B2C for multiple Azure AD tenant users, so that they could access Azure B2C application from different Azure AD tenants.

Please do correct me if there is any discrepancy in my understanding by responding in comments.

• Currently adding multiple Azure AD tenant with once instance as IDP is not supported in Azure B2C via user flow/UI.
• Each tenant must be configured separately by following Configure Azure AD as an identity provider and replacing {tenant} with the domain name of your Azure AD tenant: https://login.microsoftonline.com/**{tenant}**/v2.0/.well-known/openid-configuration
• However this could be achieved via custom policy. We could enable sign-in for users using the multi-tenant endpoint for Azure Active Directory (Azure AD). Allowing users from multiple Azure AD tenants to sign in using Azure AD B2C, without you having to configure an identity provider for each tenant. However, guest members in any of these tenants will not be able to sign in.
• Kindly follow Set up sign-in for multi-tenant Azure Active Directory using custom policies in Azure Active Directory B2C to configure this.

Thanks,

Akshay Kaushik

Please "Accept the answer", "Upvote" and share your feedback (Yes/No) if the suggestion works as per your business need. This will help us and others in the community as well.