migrate users from legacy SQL DB to azure B2C

Question

Hi everyone,

I would like to migrate users from in-house legacy idp to azure ad b2c. The legacy idp is a web app that has an SQL DB which contains users and hashed passwords.

I've concluded in the documentation that I would use the Seamless Migration approche due to the fact that I don't have access to clear text passwords. But I'm not sure if it's the right decision. Is there someone who can confirm this?

In addition, I would love to know the things that I would be take into consideration during the migration phase.

Thank you.

Answer 1

Hi @Alaa Nasser ,

Thanks for reaching out.

Just-in-Time (JIT) migration is a good approach when the user's password is not accessible, such as when passwords are stored in a hashed format or in an identity provider that you don't have access to.

JIT Migration v1 and v2 are two different versions of the JIT migration feature in Azure AD B2C. In both versions, Azure AD B2C calls a REST API to validate the user's credentials, but the difference is in how the account is migrated to Azure AD B2C. In JIT v1, the account is migrated with a Graph API call, while in JIT v2, the user profile is returned to Azure AD B2C from an Azure Table, and Azure AD B2C creates the account in the directory.

Seamless account migration is another approach to migrating users to Azure AD B2C. In this approach, accounts have been pre-migrated into Azure AD B2C, and you want to update the password on the account on initial sign-in. Azure AD B2C calls a REST API to validate the credentials for accounts marked as requiring migration (via attribute) against a legacy identity provider, returns a successful response to Azure AD B2C, and Azure AD B2C writes the password to the account in the directory.

The Seamless Migration approach would be the best suited for migrating users from your in-house legacy identity provider to Azure AD B2C. This approach involves pre-migrating user accounts to Azure AD B2C, and then using a custom policy to query a REST API to set each user's password at first sign-in. This approach allows you to migrate user accounts without requiring users to reset their passwords or take other actions, which can help minimize disruption to users and simplify the migration process.

Things to take care while migration - https://learn.microsoft.com/en-us/azure/active-directory-b2c/user-migration#directory-cleanup

Hope this will help.

Thanks,

Shweta

Please "Accept the answer" if above answer helped you.