Why are my Azure B2C users being set to disabled?

Question

Why are my Azure B2C users being set to disabled?

Nathan Bell 0

I have an Azure B2C tenant where some users are being set to disabled for reasons I cannot determine. We have no custom policies or "access reviews". We have no custom code or scripts running. The users are just somehow being set to disabled in Azure B2C by the system. Most of these users are using third party identity providers, so it's not that they are getting locked out for too many bad password attempts. I can't find anything in the logs, and I'm not sure where to look.

Vigneshwar Duvva 2,300 Reputation points Microsoft External Staff Moderator

2025-04-12T01:41:45.4466667+00:00

Hello Nathan Bell

Greetings!

As you can see in audit logs is there any changes has been made to the users in last 30 days.

Hope this helps. Do let us know if you have any further queries

And also I would like to check this up offline with you to understand the scenario better. Please share your contact details over private message and your availability for a call.
Vigneshwar Duvva 2,300 Reputation points Microsoft External Staff Moderator

2025-04-14T23:51:40.4633333+00:00

Hello Nathan Bell

Greetings!

I have shared the meeting invite in teams tomorrow 12:00PM CST.

Thank you.
Vigneshwar Duvva 2,300 Reputation points Microsoft External Staff Moderator

2025-04-15T17:09:51.0333333+00:00

Hello Nathan Bell

Just checking in to see if above information was helpful. If you have any further updates on this issue, please feel free to post back
Vigneshwar Duvva 2,300 Reputation points Microsoft External Staff Moderator

2025-04-15T22:56:04.06+00:00

Hello Nathan Bell

I have sent you an email regarding my finding.

I hope this information helps to you and let me know if you have any further questions, we will be happy to help you.
Vigneshwar Duvva 2,300 Reputation points Microsoft External Staff Moderator

2025-04-17T21:48:04.0733333+00:00

Hello Nathan Bell

We apologize for the delay. We are currently investigating the root cause of the issue and consulting with experts to determine why users' statuses are shown as disabled when they log in with social accounts to the B2C application.

We appreciate your patience.
Vigneshwar Duvva 2,300 Reputation points Microsoft External Staff Moderator

2025-04-22T19:47:36.0666667+00:00

Hello Nathan Bell

It’s because those are always disabled, and the check is skipped since that check occurs when B2C checks the backend for creds.

Use this sample https://github.com/azure-ad-b2c/samples/tree/master/policies/disable-social-account-from-logon
Nathan Bell 0 Reputation points

2025-04-22T22:12:59.2533333+00:00

I don't understand your response. It is because what is disabled? Do you mean user accounts? Why are they disabled? What setting is causing them to be disabled? When we went through the settings via screenshare the other day you were unable to find a setting that produced this outcome. Have you found it now? What is it? What does that sample script have to do with my tenant? As we already established, I am not using any custom scripts.
Rukmini 3,841 Reputation points Microsoft External Staff Moderator

2025-04-23T13:25:02.9366667+00:00

@Nathan Bell, We will check this internally and get back to you shortly.
SrideviM 5,705 Reputation points Microsoft External Staff Moderator

2025-04-24T03:11:52.0866667+00:00
Hello Nathan Bell,

Apologies for the delayed response and thank you for your patience.

After reviewing your Azure AD B2C setup, we noticed that you're using a custom policy, and the users being marked as disabled are those signing in with third-party identity providers such as Google, Facebook, Microsoft, or Apple.

This occurs because B2C creates these federated accounts without a local password, and by default, such accounts are automatically marked as disabled. This behavior is designed to prevent password-less accounts from being used for local sign-ins. Even if the policy attempts to enable the account, B2C overrides that setting at the time of creation.

This is a known and expected behavior, as confirmed in the following Microsoft Q&A threads:

https://learn.microsoft.com/en-us/answers/questions/1623414/azure-ad-b2c-custom-policy-how-can-we-change-accou

https://learn.microsoft.com/en-us/answers/questions/1572389/azure-b2c-custom-policy-created-users-are-automati

If you want these users to show as enabled and be able to use your app, you have a couple of options. You can add a step in your policy after the account is created to update the user and enable the account. Or, if you're just using this status inside your app, you can create a custom attribute to track if the user is active.

Hope this helps clear things up.

Kindly consider upvoting this comment if the information was helpful, as it may assist others facing a similar issue.

If you have any further questions, feel free to reach out!
SrideviM 5,705 Reputation points Microsoft External Staff Moderator

2025-04-25T01:34:50.3166667+00:00

Hello Nathan Bell,

Did you get a chance to see my previous comment, let me know if I can be of help to you. If you have any further query do let us know
Nathan Bell 0 Reputation points

2025-05-01T19:04:40.2266667+00:00

How do you accomplish this "You can add a step in your policy after the account is created to update the user and enable the account". Are there step by step instructions somewhere?
Rukmini 3,841 Reputation points Microsoft External Staff Moderator

2025-05-05T12:48:15.98+00:00

@Nathan Bell, We will check internally and get back to you shortly.