Email MFA for specific users in AD B2C

Question

Hi, We want to implement email MFA for some users in our AD B2C, based on the flag in our database. Currently, we are using custom policies and have a P2 license. Could you provide an example for this scenario, if you have one available?

Answer 1

Hi @Rets you can use a combination of Azure AD B2C custom policies and Azure Functions. Here's an example of how you can do it:

1. Create an Azure Function that sends an email with a verification code to the user's email address. You can use SendGrid or any other email service for this.
2. In your AD B2C custom policy, add a new claims provider that calls the Azure Function to send the email with the verification code.
3. Add a new technical profile that prompts the user to enter the verification code sent to their email address.
4. Add a validation technical profile that validates the verification code entered by the user.
5. In your AD B2C custom policy, add a new orchestration step that checks the flag in your database to determine whether to use email MFA or another MFA method.
6. If the flag is set to use email MFA, call the claims provider and technical profiles you created in steps 2-4.
7. If the flag is not set to use email MFA, call the other MFA method you want to use.

Here's an example of what the technical profile for sending the email with the verification code might look like:

TechnicalProfile Id="SendEmail">
  <DisplayName>Send email</DisplayName>
  <Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.AzureFunctionProtocolProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
  <Metadata>
    <Item Key="ServiceUrl">https://yourfunctionapp.azurewebsites.net/api/sendemail</Item>
    <Item Key="SendTimeoutInSeconds">30</Item>
    <Item Key="AuthenticationType">None</Item>
  </Metadata>
  <CryptographicKeys>
    <Key Id="BasicAuthenticationUsername" StorageReferenceId="B2C_1A_FunctionAppUsername" />
    <Key Id="BasicAuthenticationPassword" StorageReferenceId="B2C_1A_FunctionAppPassword" />
  </CryptographicKeys>
  <InputClaims>
    <InputClaim ClaimTypeReferenceId="email" PartnerClaimType="email" />
    <InputClaim ClaimTypeReferenceId="verificationCode" />
  </InputClaims>
  <OutputClaims>
    <OutputClaim ClaimTypeReferenceId="emailSent" DefaultValue="true" />
  </OutputClaims>
</TechnicalProfile>

In this example, the technical profile uses the Azure Function protocol provider to call an Azure Function that sends an email with the verification code to the user's email address. The ServiceUrl metadata item specifies the URL of the Azure Function, and the InputClaims section specifies the email address and verification code to be sent in the email. The OutputClaims section specifies that the emailSent claim should be set to true after the email is sent. Please let me know if you have any questions and I can help you further. If this answer helps you please mark "Accept Answer" so other users can reference it.

Thank you,

James