Azure AD B2C guessable password policy not applied to Password Reset user flow

Question

I have an ASP.NET Core web app that uses Azure AD B2C for user authentication.

I'm noticing some strange behaviour with users setting their passwords using the forgotten password feature and the change password feature.

When users go through the in-built forgotten password process (sign in user flow/policy), they are not allowed to enter passwords with guessable words (e.g. Password1)

However when they are logged in and want to change their password, the guessable passwords rule is not applied (this feature was enabled by creating a Password Reset user flow in B2C).

Why is this behaviour not consistent across both processes?

Why does the Password Reset user flow not do the guessable password check?

Answer 1

@Umar Ali

Thank you for posting your query on Microsoft Q&A. From above description I could understand that you are looking for custom banned password in password reset user flow.

However we don't have these options in user flow. Since Authentication methods > Password protection banned password is not enabled without an Azure AD Subscription.

Rather you could achieve this with custom policies.

Kindly follow A B2C IEF Custom Policy - Sign up and Password reset with banned password list for XML.

Thanks,

Akshay Kaushik

Please "Accept the answer" (Yes), and share your feedback if the suggestion answers you’re your query. This will help us and others in the community as well.