Need to create same App Registration for Parent tenant and Nested B2C tenant

ShashankSaxena-2458 131

Hello All,

I'm dealing with some odd challenges because we have three tenants: 1. ABC.com 2. abc.onmicrosoft.com (a subdomain of ABC.com) 3. B2C tenant (established under abc.msn.com). We have a requirement where we need to configure one App Registration on both sides on 1 & 3 where the application access URL is the same (as per the requirement) and when users from Tenant 1 access the URL, they are redirected to Tenant 1 for authentication and when B2C users from Tenant 2 access the same URL, they are redirected to Tenant 3 for authentication. Is that demand feasible, and if so, how?

Akshay-MSFT 16,026 Reputation points Microsoft Employee

2023-05-11T07:04:08.6033333+00:00

@Anonymous

Hope you got a chance to review the action plan suggested below. Please do let me know if you have any queries in the comments section. If you don't have any further queries and the suggestion works as per your business need. Please "Accept the answer(Yes)" and "share you feedback ". This will help us and others in the community as well.

Thanks,

Akshay Kaushik
Akshay-MSFT 16,026 Reputation points Microsoft Employee

2023-05-12T10:38:54.8933333+00:00

@Anonymous

I am following up to see if you were able to follow the action plan suggested below. Please do let me know if you have any queries in the comments section. If you don't have any further queries and the suggestion works as per your business need. Please "Accept the answer", "Upvote" and rate your experience. This will help us and others in the community as well.

Thanks,

Akshay Kaushik

2 answers

Akshay-MSFT 16,026 Reputation points Microsoft Employee

2023-05-04T08:47:36.4733333+00:00
@Anonymous

Thanks for posting your query on Microsoft Q&A. From above description I could understand that you need to configured 2 application with same URL, where users from Tenant T1 should be able to access data from application hosted in Tenant T1.

And users from tenant T2 should be able to access application hosted on B2C tenant T3.

Please do let me know in the comments if this is not correct, else try following below suggestion:

Create an application in T1 with

Accounts in this organizational directory only (T1 only - Single tenant) in Supported account types

For 2nd application in B2C tenant T3 follow Set up sign-in for a specific Azure Active Directory organization (T2 in this case) in Azure Active Directory B2C

Here while Configuring Azure AD as an identity provider select directory name of T2 (abc.onmicrosoft.com) to replace tenant below:

https://login.microsoftonline.com/{tenant}/v2.0/.well-known/openid-configuration

If you have 1 application hosted in B2C tenant, then

You need to integrate AAD of Tenant 1 with B2C as an IDP, this would allow users from T1 to authenticate with T3 B2C tenant as federated users.

Similarly you must allow local account signup. This would be used by users from T2 to register as local user, in this case all the authentication would be taken care by Azure AD B2C tenant T3.

The users will be registered as consumer accounts( local and federated B2C accounts), none of the above steps would create guest accounts in B2C tenant.

A local account refers to an account that is created in your Azure AD B2C directory when a user signs up for your application or an admin creates the account. Usernames and passwords are stored locally and Azure AD B2C serves as the identity provider for local accounts.

Federated sign-in

You can configure Azure AD B2C to allow users to sign in to your application with credentials from external social or enterprise identity providers (IdPs). Azure AD B2C supports many external identity providers and any identity provider that supports OAuth 1.0, OAuth 2.0, OpenID Connect, and SAML protocols.

With external identity provider federation, you can offer your consumers the ability to sign in with their existing social or enterprise accounts, without having to create a new account just for your application.

On the sign-up or sign-in page, Azure AD B2C presents a list of external identity providers the user can choose for sign-in. Once they select one of the external identity providers, they're redirected to the selected provider's website to complete the sign-in process. After the user successfully signs in, they're returned to Azure AD B2C for authentication of the account in your application.

Please do let me know if you have any further queries.

Thanks,

Akshay Kaushik

Please "Accept the answer" (Yes), and share your feedback if the suggestion answers you’re your query. This will help us and others in the community as well.
Please sign in to rate this answer.

1 person found this answer helpful.
ShashankSaxena-2458 131 Reputation points

2023-05-04T11:01:35.52+00:00

Thanks @Akshay-MSFT for the response, let me repeat that the application would be the same on both sides, including the application access URL, but there would be a difference in authentication, which means that when a user from Tenant-A tries to access the URL, it will automatically authenticate from Tenant-A, whereas when a user from Tenant-C tries to access the same application URL, it will be authenticated by the B2C tenant, and this should be done automatically. Is this possible?

Akshay-MSFT 16,026 Reputation points Microsoft Employee

2023-05-09T08:51:10.0266667+00:00

@Anonymous

I was OOF so was not able not respond earlier. If you have a common application hosted in B2C tenant, then

You need to integrate AAD of Tenant 1 with B2C as an IDP, this would allow users from T1 to authenticate with T3 B2C tenant as federated users.

Similarly you must allow local account signup. This would be used by users from T2 to register as local user, in this case all the authentication would be taken care by Azure AD B2C tenant T3.

Please do let me know if you have any further queries in the comments.

Thanks,

Akshay Kaushik

Please "Accept the answer" (Yes), and share your feedback if the suggestion answers you’re your query. This will help us and others in the community as well.

ShashankSaxena-2458 131 Reputation points

2023-05-09T09:25:13.65+00:00

Hello @Akshay-MSFT ,

Please correct me if I am wrong as per the below process:

we will configure App Registration on both the side using the option Multi-Tenant option and the same Redirection URL on both tenants

We will provide Endpoint URLs either OAuth or OpenID Connect to the Application Owner team and they will add those URLs to their application code for the authentication

now when the user of any tenant will try to access the application using the same URL, it will automatically authenticate the user from their respective tenant(either Primary tenant or B2C tenant)

Let me know if I need to do anything else from the Azure IAM side.

Akshay-MSFT 16,026 Reputation points Microsoft Employee

2023-05-09T11:00:21.1533333+00:00

@Anonymous ,

PFB answers inline:

we will configure App Registration on both the side using the option Multi-Tenant option and the same Redirection URL on both tenants.

No, Register an Azure AD app with default selection of Accounts in this organizational directory only (Default Directory only - Single tenant) for this application. Configure Azure AD as an identity provider, T1 is your case

We will provide Endpoint URLs either OAuth or OpenID Connect to the Application Owner team and they will add those URLs to their application code for the authentication. Yes

now when the user of any tenant will try to access the application using the same URL, it will automatically authenticate the user from their respective tenant(either Primary tenant or B2C tenant)

Since T1 Azure AD would be integrated as IDP, users from this tenant will be guest users on AzureB2C tenant and will be able to access only post authentication from T1. Since T2 would not be integrated, users will have to register as local users and subsequent authentication will be done by B2C tenant

Please do let me know know if you if you have any further queries.

Thanks,

Akshay Kaushik

Please "Accept the answer" (Yes), and share your feedback if the suggestion answers you’re your query. This will help us and others in the community as well.

ShashankSaxena-2458 131 Reputation points

2023-05-10T04:40:27.0566667+00:00

@Akshay-MSFT ,

I don't know whether you have gone through that or not, but Guest users in Azure AD B2C tenant can only be used for the administrative work, they are not allowed to access the application, please check the below article from Microsoft:

Akshay-MSFT 16,026 Reputation points Microsoft Employee

2023-05-10T05:06:11.4133333+00:00

@Anonymous

The users will be registered as consumer accounts( local and federated B2C accounts), none of the above steps would create guest accounts in B2C tenant.

A local account refers to an account that is created in your Azure AD B2C directory when a user signs up for your application or an admin creates the account. Usernames and passwords are stored locally and Azure AD B2C serves as the identity provider for local accounts.

Federated sign-in

You can configure Azure AD B2C to allow users to sign in to your application with credentials from external social or enterprise identity providers (IdPs). Azure AD B2C supports many external identity providers and any identity provider that supports OAuth 1.0, OAuth 2.0, OpenID Connect, and SAML protocols.

With external identity provider federation, you can offer your consumers the ability to sign in with their existing social or enterprise accounts, without having to create a new account just for your application.

On the sign-up or sign-in page, Azure AD B2C presents a list of external identity providers the user can choose for sign-in. Once they select one of the external identity providers, they're redirected to the selected provider's website to complete the sign-in process. After the user successfully signs in, they're returned to Azure AD B2C for authentication of the account in your application.

Please do let me know if you have any further queries.

Thanks,

Akshay Kaushik

Please "Accept the answer" (Yes), and share your feedback if the suggestion answers you’re your query. This will help us and others in the community as well.

Ahamed Fazil Buhari 0 Reputation points

2023-05-13T04:29:59.29+00:00

Hi @Akshay-MSFT thank you for your detailed answer. I have a similar usecase and would like to know whether the below requirement is feasible.

I have two tenants. T1 which acts as a main tenant and T3 which is B2C tenant(created from T1). I already set a custom flow in T3 where user can login with username by following this https://github.com/azure-ad-b2c/samples/tree/master/policies/username-or-email

Now, I would like to have an secured API App in T1 which authenticates user's in T3 with their access token and provide access to the resources in T1 through this App for T3 users.

Let me know if this is feasible. Thank you in advance.

Akshay-MSFT 16,026 Reputation points Microsoft Employee

2023-05-31T09:18:58.1533333+00:00

@Ahamed Fazil Buhari Thanks for posting your comment, I would request you to create a new thread with your query, so that it could be addressed.

Thanks,

Akshay Kaushik
Sign in to comment
ShashankSaxena-2458 131 Reputation points

2023-05-18T07:37:32.68+00:00

sorry @Akshay-MSFT for the delayed response, actually I was on vacation. but the given solution didn't work, but he managed somehow. we have created Multi tenant application on Primary tenant side and created APplication for User Flow in Azure AD B2C and asked our Developer to make the changes in their code and fortunately it worked. so thanks for the response. Appreciate your support
Please sign in to rate this answer.

1 person found this answer helpful.

0 comments No comments
Sign in to comment