How to invite external users to setup an Azure AD B2C (Local account)?

Question

How to invite external users to setup an Azure AD B2C (Local account)?

Shamayel 20

Based on our understanding of the Azure AD B2C, below are the possible options to invite external users to setup an Azure AD B2C (Local account) using user flows:

Sign up user flow - We manually send email to users with sign-up user flow endpoint.
Password reset user flow - We create user with temporary password, send them password reset link (email-based password reset).
Sign in user flow (with force password reset) - We create a user with temporary password, send them the password over email and force them to change password during first login.

Are there better ways to invite users without directly sending signup flow link or setting up a temporary password?

Alex Burlachenko 10,255 Reputation points

2025-02-24T07:48:08.98+00:00

Hey Shamayel,

U can try sending custom email invites with a link to the sign-up flow, so users can kick things off themselves. If u wanna get fancy, u can use Azure AD B2C’s custom policies and APIs to build a more seamless experience like an API that shoots an invite link straight to their email.

Other option is to enable self service sign-up in ur user flow, letting users register on their own without needing an invite. U can tweak the flow to add any extra checks or approvals u need. If u’re using Microsoft Entra External ID, that can help manage external identities more easily and cut down on the hassle.

and don’t forget about third party identity providers like Google or Facebook. Letting users sign up with their existing accounts can save u a ton of manual work. Just pick the method that vibes best with ur setup and keeps things easy for ur users.

rgds,

Alex

Accepted answer

1 additional answer

Your answer

Alex Burlachenko 10,255 Reputation points

2025-02-24T07:48:08.98+00:00

Hey Shamayel,

U can try sending custom email invites with a link to the sign-up flow, so users can kick things off themselves. If u wanna get fancy, u can use Azure AD B2C’s custom policies and APIs to build a more seamless experience like an API that shoots an invite link straight to their email.

Other option is to enable self service sign-up in ur user flow, letting users register on their own without needing an invite. U can tweak the flow to add any extra checks or approvals u need. If u’re using Microsoft Entra External ID, that can help manage external identities more easily and cut down on the hassle.

and don’t forget about third party identity providers like Google or Facebook. Letting users sign up with their existing accounts can save u a ton of manual work. Just pick the method that vibes best with ur setup and keeps things easy for ur users.

rgds,

Alex

Answer 1

Kancharla Saiteja 5,890 Microsoft External Staff Moderator

Hi @Shamayel,

Thank you for posting your query on Microsoft Q&A. I am Saiteja from Q&A will be assisting you with your query.

Based on your query, I understand you would like to have sign up for specific audience.

In addition to @Alex Burlachenko I would like to add my points to make it easy with a different method.

Since you would like to have sign up for specific audience, you can create a custom attribute and import it to the user flow to restrict the sign up.

Here is the GitHub document to check if this can help you achieving your end goal: active-directory-node-b2c-user-flow-invitation-code.

Here is another possible way to send the email address as ID token hint which allows users to create their account: SignUp with email invitation

I hope this information is helpful. Please feel free to reach out if you have any further questions.

If the answer is helpful, please click "Accept Answer" and kindly "upvote it". If you have extra questions about this answer, please click "Comment"

Kancharla Saiteja 5,890 Reputation points Microsoft External Staff Moderator

2025-02-28T04:12:54.8966667+00:00

Hi @Shamayel,

Following up to see if the above answer was helpful. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.
Kancharla Saiteja 5,890 Reputation points Microsoft External Staff Moderator

2025-03-03T04:08:17.7933333+00:00

Hi @Shamayel,

Following up to see if the above answer was helpful. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.

Answer 2

Alex Burlachenko 10,255

Hey Shamayel,

U can try sending custom email invites with a link to the sign-up flow, so users can kick things off themselves. If u wanna get fancy, u can use Azure AD B2C’s custom policies and APIs to build a more seamless experience like an API that shoots an invite link straight to their email.

Other option is to enable self service sign-up in ur user flow, letting users register on their own without needing an invite. U can tweak the flow to add any extra checks or approvals u need. If u’re using Microsoft Entra External ID, that can help manage external identities more easily and cut down on the hassle.

and don’t forget about third party identity providers like Google or Facebook. Letting users sign up with their existing accounts can save u a ton of manual work. Just pick the method that vibes best with ur setup and keeps things easy for ur users.

rgds,

Alex

Shamayel 20 Reputation points

2025-02-24T09:34:42.57+00:00

Hi @Alex Burlachenko ,
Thank you for providing options.

We need to ensure that only invited users, whether they signed up using Email ID and password or through OpenID Connect, can sign up to Azure AD B2C. In other words, only users who receive an invitation from our application should have the option to sign up.

Is there any way we can send a sign-up flow link that includes the email ID, so that users can only sign up with the invited email ID? Currently, when we send the sign-up user flow endpoint to users, they have the ability to enter any email ID and register in B2C, which is not what we want.
Alex Burlachenko 10,255 Reputation points

2025-02-24T10:41:46.5633333+00:00

Shamayel hi again :)

u can use custom policies in b2c. these let u tweak the sign-up process big time. u can set it up so it checks if the email’s in a pre-approved list, like a db or somethin’. if the email ain’t in the list, boom, no sign-up for ‘em.

another trick is to pre-fill the email in the sign-up link. like, u send ‘em a link with their email already in it, so they can’t change it. u just add the email as a query param in the url, somethin’ like https://yourtenant.b2clogin.com/yourtenant.onmicrosoft.com/oauth2/v2.0/authorize?client_id=yourclientid&response_type=code&scope=openid&redirect_uri=yourredirecturi&email=inviteduser@example.com. then, in the custom policy, u grab that email and auto-fill it in the form. make sure they can’t edit it, tho.

or, u can go the invitation code route. u generate a unique code for each invite, stash it in a db, and send it to ‘em in the link. when they hit the sign-up flow, u ask for the code and check if it matches the one in the db. no match? no sign-up.

if all ur invited users are from specific domains, like ur company domain, u can just restrict sign-ups to those domains. u can do this in the user flow settings or with custom policies.

lastly, if u can’t lock it down during sign-up, u can do it after. once they sign up, u check if their email’s in the invited list. if not, u just disable or delete their account.

so yeah, u got options. custom policies, pre-filled emails, invitation codes, domain restrictions, or post-sign-up checks.

rgds,

Alex

Share via

How to invite external users to setup an Azure AD B2C (Local account)?

1 additional answer

Your answer