Would it be possible to create an Azure AD b2c tenant and register an application in the newly created tenant with a set of API permission, create user flows.

Question

Would it be possible to create an Azure AD B2C tenant and register an application in the newly created tenant with a set of API permission, create user flows.

As part of provisioning a platform, we would like to use bicep / terraform / Az cli commands to achieve the following :

• Create Azure AD B2C tenant.
• Register an App in it with a set of API Permissions , Admin consent the same.
• Assign the newly added application as a User Administrator under new tenant -> Manage -> Roles and administrators -> User Administrator
• Add user flows.

If all of the above is possible , then what is the kind of authentication would the scripts containing bicep / terraform / Az cli scripts. Or if the above would need to be done in different steps , what are the recommendations.

Answer 1

@Rajesh MS

Thank you for your post and I apologize for the delayed response!

To hopefully help point you in the right direction and resolve your issue, you can reference the steps below to achieve your tasks.

Create Azure AD B2C tenant

Note: You can't update an existing B2C tenant or redeploy a template with the same tenant name.

• You can create a B2C tenant with an ARM template or Bicep file, but you can't update an existing B2C tenant. If you need to update a B2C tenant, use B2C Tenants - Update.

resource symbolicname 'Microsoft.AzureActiveDirectory/b2cDirectories@2021-04-01' = {
  name: 'string'
  location: 'string'
  tags: {
    tagName1: 'tagValue1'
    tagName2: 'tagValue2'
  }
  sku: {
    name: 'string'
    tier: 'A0'
  }
  properties: {
    createTenantProperties: {
      countryCode: 'string'
      displayName: 'string'
    }
  }
}

Additional Links:

• B2C Tenants - Create REST API

---

Register a B2C App with API Permissions and Admin consent the permissions.

To create a web application, web API, or native application within your B2C tenant you can leverage the below az ad app CLI commands.

• az login
• az ad app create
• az ad app permission add
• az ad app permission admin-consent

#Login to your Azure B2C tenant
az login --tenant 'b2cTenantName.onmicrosoft.com'

#Create a web application, web API or native application.
az ad app create --display-name mytestapp

#Add API permissions.
az ad app permission add --id {appId} --api 00000003-0000-0000-c000-000000000000 --api-permissions e1fe6dd8-ba31-4d61-89e7-88639da4683d=Scope

#Grant Application & Delegated permissions through admin-consent. 
#You must login as a Global Administrator.
az ad app permission admin-consent --id 00000000-0000-0000-0000-000000000000

Additional Links:

• Az CLI - Register an Azure AD B2C Application
• B2C Applications Rest API
• How do I use Bicep (or ARM) to create an AD app registration and roles?
• Creating App Registration with ARM templates/Bicep - 3rd party walkthrough

---

Assign the application a Microsoft Entra role (i.e., User Administrator)

When it comes to assigning your Azure B2C Application a Microsoft Entra role, you'll need to use PowerShell or the Microsoft Graph API. For more info - Microsoft Entra role-based access control.

• List the directory roles that are activated in your tenant to get the User Admin roleDefinitionId

GET https://graph.microsoft.com/v1.0/directoryRoles

• Create a role assignment for your Azure B2C Application using the application's ObjectID. For more info - POST Operations on RoleAssignment.

POST https://graph.microsoft.com/v1.0/roleManagement/directory/roleAssignments
Content-type: application/json

{ 
    "@odata.type": "#microsoft.graph.unifiedRoleAssignment",
    "roleDefinitionId": "c2cf284d-6c41-4e6b-afac-4b80928c9034",
    "principalId": "f8ca5a85-489a-49a0-b555-0a6d81e56f0d",
    "directoryScopeId": "/"
}

Additional Links:

• Assign custom admin roles using the Microsoft Graph API in Microsoft Entra ID
• Assign custom roles with resource scope using PowerShell in Microsoft Entra ID
• roleManagement resource type - Microsoft Graph
• List applications - Microsoft Graph REST API

---

Adding User Flows

The b2cIdentityUserFlow resource type within the Microsoft Graph REST API gives you the capability to configure pre-built policies for sign-up, sign-in, combined sign-up and sign-in, password reset, and profile update. For more info.

• Example - Create a user flow with the default values

POST https://graph.microsoft.com/beta/identity/b2cUserFlows
Content-type: application/json

{
    "id": "Customer",
    "userFlowType": "signUpOrSignIn",
    "userFlowTypeVersion": 3
}

Additional Links:

• Manage Azure AD B2C with Microsoft Graph
• Deploy custom policies with GitHub Actions

I hope this helps!

If you have any other questions, please let me know. Thank you for your time and patience throughout this issue.

---

If the information helped address your question, please Accept the answer. This will help us and also improve searchability for others in the community who might be researching similar information.