Azure AD B2C: Multi-Tenant Entra ID automatically enable accounts

Question

I have followed this tutorial to set up sign-in for multitenant Microsoft Entra ID using custom policies in Azure Active Directory B2C. Everything is working except all newly created accounts are disabled by default. I would like to have all new accounts (either local or via social logins) to automatically be enabled.

I found a similar question, but as far as I can tell, the AAD-UserWriteUsingLogonEmail technical profile is not being used. The closes thing I could find was the AAD-UserWriteUsingAlternativeSecurityId profile, but adding <OutputClaim ClaimTypeReferenceId="accountEnabled" DefaultValue="true" /> or <PersistedClaim ClaimTypeReferenceId="accountEnabled" DefaultValue="true" /> had any affect on automatically enabling the account.

Given the flow from the tutorial, where is the proper place to have the accountEnabled set to true?

Answer 1

Hi @Jeremy Ramsey , here's an example using AAD-UserWriteUsingAlternativeSecurityId. If this doesn't work we can open a support ticket and see what's going on.

Add the following line to the AAD-UserWriteUsingAlternativeSecurityId technical profile:

<PersistedClaim ClaimTypeReferenceId="accountEnabled" DefaultValue="true" />

This will set the accountEnabled attribute to true for all newly created accounts. Make sure to add this line within the PersistedClaims element of the technical profile.

Here's an example of what the AAD-UserWriteUsingAlternativeSecurityId technical profile should look like with the accountEnabled attribute added:

<TechnicalProfile Id="AAD-UserWriteUsingAlternativeSecurityId">
  <Metadata>
    <Item Key="Operation">Write</Item>
    <Item Key="RaiseErrorIfClaimsPrincipalAlreadyExists">true</Item>
  </Metadata>
  <PersistedClaims>
    <PersistedClaim ClaimTypeReferenceId="alternativeSecurityId" />
    <PersistedClaim ClaimTypeReferenceId="email" />
    <PersistedClaim ClaimTypeReferenceId="newPassword" PartnerClaimType="password"/>
    <PersistedClaim ClaimTypeReferenceId="displayName" />
    <PersistedClaim ClaimTypeReferenceId="givenName" />
    <PersistedClaim ClaimTypeReferenceId="surname" />
    <PersistedClaim ClaimTypeReferenceId="objectId" />
    <PersistedClaim ClaimTypeReferenceId="tenantId" />
    <PersistedClaim ClaimTypeReferenceId="accountEnabled" DefaultValue="true" />
  </PersistedClaims>
  <OutputClaims>
    <OutputClaim ClaimTypeReferenceId="objectId" />
    <OutputClaim ClaimTypeReferenceId="newUser" PartnerClaimType="newClaimsPrincipalCreated" />
    <OutputClaim ClaimTypeReferenceId="tenantId" AlwaysUseDefaultValue="true" DefaultValue="{Policy:TenantObjectId}" />
  </OutputClaims>
  <IncludeTechnicalProfile ReferenceId="AAD-Common" />
  <UseTechnicalProfileForSessionManagement ReferenceId="SM-AAD" />
</TechnicalProfile>

Please let me know if you have any questions and I can help you further.

If this answer helps you please mark "Accept Answer" so other users can reference it.

Thank you,

James