can i automate the userflow like sigin and sigup using graph

Haroon Khan 0 Reputation points
2025-03-10T07:53:00.9+00:00

can i automate the userflow like sigin and sigup using graph i create the app using az cli

#!/bin/bash

# Set Variables
TENANT_ID="6b74c8"
APP_NAME="Myb2capp1"
REDIRECT_URI="http://localhost:3000/"

# Log into Azure
echo "πŸ”„ Logging into Azure..."
az login --tenant "$TENANT_ID" --allow-no-subscriptions > /dev/null 2>&1
if [[ $? -ne 0 ]]; then
    echo "❌ Azure login failed. Ensure your credentials are correct."
    exit 1
fi

# Ensure correct tenant

echo "πŸ”„ Checking Azure Tenant..."
CURRENT_TENANT=$(az account show --query "tenantId" -o tsv)
if [[ "$CURRENT_TENANT" != "$TENANT_ID" ]]; then
    echo "❌ You are not logged into the correct tenant ($TENANT_ID)."
    exit 1
fi

# Check if the app already exists
EXISTING_APP_ID=$(az ad app list --display-name "$APP_NAME" --query "[].appId" -o tsv)

if [[ -n "$EXISTING_APP_ID" ]]; then
    echo "ℹ️ App '$APP_NAME' already exists. Using existing App ID: $EXISTING_APP_ID"
    APP_ID=$EXISTING_APP_ID
else
    # Create the App Registration
    echo "πŸ”„ Creating Azure AD B2C app: $APP_NAME..."
    APP_ID=$(az ad app create \
      --display-name "$APP_NAME" \
      --web-redirect-uris "$REDIRECT_URI" \
      --query appId -o tsv)

    if [[ -z "$APP_ID" ]]; then
        echo "❌ Failed to create the Azure AD B2C app."
        exit 1
    fi
    echo "βœ… App created successfully with ID: $APP_ID"
fi

# Assign API Permissions
echo "πŸ”„ Assigning API permissions..."
az ad app permission add --id "$APP_ID" --api 00000003-0000-0000-c000-000000000000 \
  --api-permissions 311a71cc-e848-46a1-bdf8-97ff7156d8e6=Scope \
                     37f7f235-527c-4136-accd-4a02d197296e=Scope > /dev/null 2>&1

if [[ $? -ne 0 ]]; then
    echo "❌ Failed to assign API permissions."
    exit 1
fi
echo "βœ… Permissions assigned successfully."

# Grant Admin Consent
echo "πŸ”„ Granting admin consent..."
az ad app permission admin-consent --id "$APP_ID" > /dev/null 2>&1
if [[ $? -ne 0 ]]; then
    echo "❌ Failed to grant admin consent."
    exit 1
fi
echo "βœ… Admin consent granted successfully."

# Check if Service Principal Exists
SP_EXIST=$(az ad sp list --filter "appId eq '$APP_ID'" --query "[].id" -o tsv)

if [[ -z "$SP_EXIST" ]]; then
    echo "πŸ”„ Creating service principal..."
    az ad sp create --id "$APP_ID" > /dev/null 2>&1
    if [[ $? -ne 0 ]]; then
        echo "❌ Failed to create service principal."
        exit 1
    fi
else
    echo "ℹ️ Service Principal already exists. Skipping creation."
fi

# Enable Implicit Grant with Retry
echo "πŸ”„ Enabling implicit grant..."
for i in {1..3}; do
    az rest --method PATCH --url "https://graph.microsoft.com/v1.0/applications/$APP_ID" \
      --headers "Content-Type=application/json" \
      --body '{
        "web": {
          "implicitGrantSettings": {
            "enableAccessTokenIssuance": true,
            "enableIdTokenIssuance": true
          }
        }
      }' > /dev/null 2>&1

    if [[ $? -eq 0 ]]; then
        echo "βœ… Implicit grant enabled."
        break
    else
        echo "⚠️ Failed to enable implicit grant. Retrying ($i/3)..."
        sleep 5
    fi
done

# Verify the App Registration
echo "πŸ”„ Verifying the app registration..."
az ad app show --id "$APP_ID" > /dev/null 2>&1
if [[ $? -ne 0 ]]; then
    echo "❌ Failed to verify app registration."
    exit 1
fi
echo "βœ… App registration verified successfully."

# Run PowerShell script for User Flow
echo "πŸ”„ Running PowerShell script to create Sign-Up & Sign-In user flow..."
pwsh -File create_susi.ps1 -TenantId "$TENANT_ID"

if [[ $? -ne 0 ]]; then
    echo "❌ Failed to create B2C SUSI user flow."
    exit 1
fi

echo "πŸŽ‰ Azure AD B2C SUSI User Flow setup completed successfully! βœ…"
b2c file:

param (
    [string]$TenantId
)

# Connect to Microsoft Graph with required permissions
Connect-MgGraph -Scopes "IdentityUserFlow.ReadWrite.All", "Application.ReadWrite.All"

# Define User Flow Name
$UserFlowName = "B2C_1_SignUpSignIn"

# Check if the user flow already exists
$ExistingFlow = Get-MgIdentityUserFlow | Where-Object { $_.Id -eq $UserFlowName }

if ($ExistingFlow) {
    Write-Output "ℹ️ User Flow '$UserFlowName' already exists. Skipping creation."
} else {
    # Create a Sign-Up & Sign-In User Flow
    $UserFlow = New-MgIdentityUserFlow -Id $UserFlowName -UserFlowType "signUpOrSignIn"

    # Use Email as Identifier
    Update-MgIdentityUserFlow -IdentityUserFlowId $UserFlow.Id -UserFlowType "signUpOrSignIn" -UserFlowTypeVersion 1 -IdentityProviders @(@{"id"="Email";"identityProviderType"="EmailAddress"})

    # Add Claims (Email, Name, etc.)
    $Claims = @("email", "displayName", "givenName", "surname")
    foreach ($claim in $Claims) {
        New-MgIdentityUserFlowAttributeAssignment -IdentityUserFlowId $UserFlow.Id -UserAttribute $claim -IsOptional $false
    }

    Write-Output "βœ… B2C User Flow '$UserFlowName' created successfully with Email as Identifier and Claims."
}

# Confirm Creation
Get-MgIdentityUserFlow | Where-Object { $_.Id -eq $UserFlowName }

Microsoft Graph
Microsoft Graph
A Microsoft programmability model that exposes REST APIs and client libraries to access data on Microsoft 365 services.
13,310 questions
0 comments No comments
{count} votes

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.