We would like to allow users to select MFA method during signing in. User goes to our App App redirects the user to the AD B2C login page user authenticates using e-mail + password user selects MFA method (phone or e-mail) user types the verification code that they got from Step 4 user is redirected to out app So how would one go about doing this? Do note, we are using custom journeys. Thank you

@Luka Gospodnetić Thank you for reaching out to us, for the same requirement we have sample custom policy which will help to achieve your desired result - https://github.com/azure-ad-b2c/samples/tree/master/policies/mfa-email-or-phone Let me know if you have any further questions, feel free to post back. Please remember to "Accept Answer" if answer helped, so that others in the community facing similar issues can easily find the solution.

How to allow user to select MFA method during signing in to AD B2C?

Luka Gospodnetić 5

We would like to allow users to select MFA method during signing in.

User goes to our App
App redirects the user to the AD B2C login page
user authenticates using e-mail + password
user selects MFA method (phone or e-mail)
user types the verification code that they got from Step 4
user is redirected to out app

So how would one go about doing this? Do note, we are using custom journeys.

Thank you

1 answer

Givary-MSFT 30,931 Reputation points Microsoft Employee

2023-03-21T06:07:31.3866667+00:00

@Luka Gospodnetić Thank you for reaching out to us, for the same requirement we have sample custom policy which will help to achieve your desired result - https://github.com/azure-ad-b2c/samples/tree/master/policies/mfa-email-or-phone

Let me know if you have any further questions, feel free to post back.

Please remember to "Accept Answer" if answer helped, so that others in the community facing similar issues can easily find the solution.
Please sign in to rate this answer.

1 person found this answer helpful.
Luka Gospodnetić 5 Reputation points

2023-03-21T06:14:12.87+00:00

Hi @Givary-MSFT

Thank you for responding. Unfortunately this does not solve my problem.

The sample you sent doesn't show the screen for a user to select the MFA method. It is actually saving the user's preference as a custom attribute, and then depending on the selected attributed it is offering user only one of the methods.

If a user doesn't have a phone near him, they will not be able to log in as the example expects users to sign in and go to his profile page to change the preferred MFA method.

The goals it for user to decide which MFA method they want DURING the log-in process (not after).

What is the best way to achieve this?

Tnx for the help!

Givary-MSFT 30,931 Reputation points Microsoft Employee

2023-03-21T07:50:36.4233333+00:00

@Luka Gospodnetić Above link provided is a sample to choose the preferred MFA method, however you can customize the page using CSS & Javascript - https://learn.microsoft.com/en-us/azure/active-directory-b2c/customize-ui-with-html?pivots=b2c-custom-policy to send the user back to the previous page/journey to select mfa option.

You can refer to this as well https://learn.microsoft.com/en-us/answers/questions/1071345/azure-b2c-change-mfa-in-phone-factor-step where one of my colleague explained the approach how this can be achieved.

Luka Gospodnetić 5 Reputation points

2023-03-21T09:13:44.7966667+00:00

Hi ,

Could you walk me through how this would work? I checked the links you sent. The second one, if you notice, I previously put a comment there and asked @semaja if they could share how did they achieve the final result but there is no response.

Correct me if I am wrong:

we have to make a sign-in flow that as one of the orchestration steps shows a custom form to select which MFA method the user wants

After the user selects the method, we store it as an output claim

after that, depending on the selected claim we would run either MFA Phone or MFA Email flow?!

Unfortunately, I don't see this flow in any of the links you provided, so more detailed help would be appreciated.

Tnx in advance,

Luka

semaja 26 Reputation points

2023-03-21T09:29:08.08+00:00

@Luka Gospodnetić we didn't get this working how we wanted to in the end. Due to this and other requirements we moved away from B2C as a solution. Full customization using custom policies isn't straight forward!

Luka Gospodnetić 5 Reputation points

2023-03-21T09:33:11.96+00:00

@semaja Sorry to hear that :( but still thank you for getting back to me. I basically need the same flow as you described it - giving a user an option to select MFA method right after passing through the username/password check. Option using "preferred" method is no good as this doesn't handle the case when the user doesn't have the phone near them and wants to do an MFA via e-mail.

Givary-MSFT 30,931 Reputation points Microsoft Employee

2023-03-21T09:33:42.25+00:00

@Luka Gospodnetić Please send us an email on azcommunity [at] microsoft [dot] com referencing this issue with a subject line "ATTN:Givary" along with your Azure subcription id and we will help you with support options on this, so that you can work with our support team on this further.

Luka Gospodnetić 5 Reputation points

2023-03-23T07:19:08.98+00:00

@Givary-MSFT Thank you. I will do it right away.

Atul 0 Reputation points

2023-09-27T09:43:10.09+00:00

@Givary-MSFT

As per below link its saying we can not go back to previous step of journey.

https://learn.microsoft.com/en-us/answers/questions/989713/how-to-go-to-the-previous-step-in-user-journey-azu

But in your suggestion

you can customize the page using CSS & Javascript - https://learn.microsoft.com/en-us/azure/active-directory-b2c/customize-ui-with-html?pivots=b2c-custom-policy to send the user back to the previous page/journey to select mfa option.

Can you please clarify if this is possible?
Sign in to comment

Share via

How to allow user to select MFA method during signing in to AD B2C?

1 answer