Where is Azure AD B2C account QR code for Microsoft authenticator?

Question

Where is Azure AD B2C account QR code for Microsoft authenticator?

Tony Lin 21

When I switch from my Azure primary directory to Azure AD B2C directory, I need to approve the switch in Authenticator. The account name in Authenticator is very special. The account name is admin_mydomain.com#EXT#@mydomain.onmicrosoft.com. My Azure primary directory login name is ******@mycomain.com.

I got a new phone last week. I have restored all account details to new phone and scanned all other accounts’ QR codes. But I don’t know where to fine the QR code for the special account of Azure AD B2C directory. I have never aware this issue before. I will not be able to login my AD B2C directory if I lost my phone. It is a common issue for everyone who has Azure AD B2C directory.

I set the account up first time with a pop up wizard from Azure.

Please help me with this issue. Thanks.

Accepted answer

0 additional answers

Your answer

Answer 1

AmanpreetSingh-MSFT 56,876 Moderator

@Tony Lin · Welcome to Q&A platform and thank you for your query.

The account name/upn in this format (admin_mydomain.com#EXT#@mydomain.onmicrosoft.com) gets generated for guest users. If you have added the admin of your Azure AD tenant as guest to your B2C tenant and while switching from your Azure AD tenant to the Azure AD B2C tenant, you are being prompted for MFA, it can be due to security defaults in the B2C tenant, as highlighted below:

To disable MFA prompt when switching from your primary Azure AD to B2C directory, disable "Security Defaults".

Read more: What are security defaults?

-----------------------------------------------------------------------------------------------------------

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

Tony Lin 21 Reputation points

2020-12-02T23:24:16.537+00:00

Thanks very much amanpreetsingh-msft.

I did a test as you advised. It works. But it also disables all logins MFA. I am not going to use Conditional Access. Any other solutions please.
AmanpreetSingh-MSFT 56,876 Reputation points Moderator

2020-12-03T08:36:56.143+00:00

@Tony Lin · Security Defaults and Conditional Access are the only options to enable MFA for users in B2C tenant. Why you don't want to go for Conditional Access? It doesn't require any additional licenses to be purchased in case of B2C tenant.
Tony Lin 21 Reputation points

2020-12-03T23:46:50.133+00:00

Thanks very much amanpreetsingh-msft.

Because I try not to change security settings if I can avoid. I will try condition access if there is no other solutions.

From my memory, when I set up the B2C directory, there is a wizard (Additional Security Verification wizard ) with the QR code popup. The QR code must be stored in somewhere. It is the easiest solution if we can find the QR code.
AmanpreetSingh-MSFT 56,876 Reputation points Moderator

2020-12-07T09:09:47.37+00:00

@Tony Lin · You can try running below cmdlet and enable Security Defaults again. You should be able to get the option to scan QR code to setup MFA afterwards.

Set-MsolUser -UserPrincipalName admin_mydomain.com#EXT#@mydomain.onmicrosoft.com -StrongAuthenticationMethods @()
Tony Lin 21 Reputation points

2020-12-08T10:30:01.583+00:00
Thanks very much amanpreetsingh-msft.

First, I connected to MsolService. Then I ran the cmdlet from you. I changed mydoman to my real domain name. I got error message back.

Set-MsolUser : User Not Found, User: .
At line:1 char:1

Set-MsoleUser -UserPricipalName Admin_...
...

I had checked the strange user name carefully many times. The user name should be correct. I can't find the user name anywhere. Any ideas?
AmanpreetSingh-MSFT 56,876 Reputation points Moderator

2020-12-11T15:57:25.357+00:00

Hi @Tony Lin · Make sure you are connected to B2C tenant. I would suggest you to create a new user from Azure portal in the B2C tenant and assign global admin role to the user. Make sure the UPN of the new user is ******@yourB2Ctenant.onmicrosoft.com. Connect to MsolService with the new user account and then run the cmdlet.
Tony Lin 21 Reputation points

2020-12-13T01:39:39.633+00:00

Hi @AmanpreetSingh-MSFT ,
As you advised, I created a new B2C tenant Global Admin user. I connected to Azure: Connect-Msolservice with this account. Then rerun the comlet you suggested. There is no error from PowerShell. I think that I connected to B2C tenant's AD this time.

I reactivated B2C tenant's default security and switch from main tenant to B2C tenant. A security setting wizard popup. I have scanned the QR code for the special account. Finally, I finished my MS Authenticator migration. Thanks very much.
Fabián Foos 1 Reputation point

2021-08-13T04:06:21.46+00:00

Hi @AmanpreetSingh-MSFT , I have the same problem that @Tony Lin , but I don't know how to create a new user in the B2C tenant, because it doesn't have another admin user, as the tenant was created with mine. So, how can I change security defaults? or how can I get the QR code to configure the authenticator.
Thank you in advance.

Fabián

Share via

Where is Azure AD B2C account QR code for Microsoft authenticator?

0 additional answers

Your answer