Azure B2C Client Credentials Flow not working for AzureADMultipleOrgs

Question

I'm trying to register an application in Azure AD B2C to use Client Credentials flow (Custom Policy).

I'm following this guide: https://learn.microsoft.com/en-us/azure/active-directory-b2c/client-credentials-grant-flow?pivots=b2c-custom-policy.

It all works fine if I use the application type: Accounts in this organizational directory only (Single tenant)

It fails if we register with the application type: Accounts in any organizational directory (Any Azure AD directory – Multitenant), with the error: "An application of version "V1" was found when searching for version "V2" using application identifier "04c7..."

I've updated the manifest and set accessTokenAcceptedVersion=2, but it fails with the same error.

Is there a limitation in the account type (signInAudience) when using Client Credentials flow?

I've used the same application and just by changing the manifest from

"signInAudience": "AzureADandPersonalMicrosoftAccount"

to

"signInAudience": "AzureADMultipleOrgs"

it stops working.

Answer 1

Hi @Ricardo Bicho ,

Thanks for reaching out.

Aure AD B2C User flow or custom policies are compatible with B2C specific Application Registration option "Accounts in any identity provider or organizational directory (for authenticating users with user flows)" as B2C is for consumer-based applications.

In Single app and Multi-tenant scenarios, if you need to further restricts the user to log in to your application, then RBAC is required which is not directly supported in Azure AD B2C.

Those are Azure AD/Entra ID concepts that are not respected by Azure AD B2C auth policies.

Note: Client credential flow is still in public preview and not generally available and not recommended to use for production applications.

Hope this will help.

Thanks,

Shweta

---

Please remember to "Accept Answer" if answer helped you.