Conditional Access Not Triggering in Azure AD B2C

Question

Hi ,

I’ve successfully implemented all my main Azure AD B2C flows for user migration— including custom password reset, MFA with authenticator app (via TOTP), user migration with just-in-time logic, and sign-in / sign-up orchestration. Most core flows are working well.

However, I’ve run into issues with Conditional Access (CA) not triggering as expected.

What I’ve Done So Far

• I have incorporated Microsoft’s Azure AD B2C Conditional Access GitHub repo exactly as described.
• I understood the README thoroughly and copied all the code (technical profiles, claim types, claims transformations, etc) from TrustFrameworkExtensions_ConditionalAccess.xmlinto my TrustFrameworkExtensions.xml (The one for user migration).
• I tested this in my flow by launching sign-in from Tor browser to simulate a risky login scenario — expecting to be blocked or prompted for MFA — but the sign-in proceeded normally without blocking the sign in.
• NOTE: The way my current logic is set up, i believe MFA will always be prompted to the user on sign in, im a bit uncertain on how to integrate the conditional access signals to make sure it only gets enforced on risk signals. Setting up Conditional Access for user flows directly through the azure portal is seamless. however when it comes to inetgrating this in custom policies, im unaware of the approach to do so, and all guidance would go a long way here. If its possible to explain how the ConditionalAccesssProtocolProvider is working in the custom policy (the azure provided one, this would go a long way). Also, any explanations of how the logic is working like the specfic profiles of the conditional access logic is always appreciated, i do understand it, but i may always be missing something. ive seen a few mcirosoft documentations, where we can actually write code for condeitional access as well. im not sure if this is standard for azure ad b2c, but if it is, i would very much like to know more details about it.

    Thanks for all the help!!  
    
    
    Ray
  

Answer 1

Thanks for reaching out.

Conditional access enforcement in Azure AD and B2C

the core of your question is about how to enforce the conditional access logic defined in the Azure portal through your B2C custom policies.

**1.      **Conditional access policy configuration

first it is crucial to understand that conditional policies configured and managed within the Azure portal (specially, the Microsoft entra admin center) Targeting applications, user groups and the conditions under which excess is controlled.

**2.      **Conditional Access protocol provider

the key to integrating this with your custom policies is the conditional access protocol provider that you mentioned.

The technical profile acts as the intermediary. If takes the security signals collected during the B2C usage  journey (e.g., IP address, sign in location, user state) and securely communicates with the Microsoft and track conditional access services

the CA services evaluates these signals against your configured CA policies.

The result is a set of claims returned to the B2C policy, indicating whether access should be granted, blocked or if an additional control is required.

**3.      **Implementing the logic in custom policies

For CA to trigger, you must ensure your custom policy correctly implements the necessary steps:

• send signals to the CA service

you need a text file that calls the conditional access protocol provider within your user journey. You mentioned using the code from the TrustFrameworkExtensions_ConditionalAccess.xml File from the  Microsoft entra B2C Conditional access GitHub repo. This file typically contains a technical profile like the following:

• claims provider:

conditionalAccessProtocolProvider

protocol: conditionalAccess

 

• Evaluate the result

you must then use the claims transformation or a precondition and a subsequent step of your user journey to check the value of the output claim, such as conditionalAccessResult .

If the result is granted or success the user proceeds.

If the result is mfarequired, you redirect the user to an MFA step

• if the result is blocked, you can stop the journey and present an error message.

Troubleshooting your issue

since you mentioned you have to the GitHub sample at the sign in proceeded Normally even with a risky scenario, most common points to check:

1.      CA policy scope: Ensure the CA policy in the Microsoft entra admin center is configured to apply to:

the B2C application: the application where the user is signing in must be targeted by the CA policy

all users/targeted users: the user you are testing with must be included in the policy scope.

Conditions: the condition you are testing must be set to the appropriate level (e.g, medium or high)

2.      the risk detection: confirm that the sign in is actually being marked as risky by identity protection. Check the sign in report in the Microsoft entra admin center For this specific sign in event to verify the sign in risk is not none.

3.      Correct technical profile execution: use application insights to trace the execution of your B2C policy. Verify that the conditional access check technical profile is being executed in the user journey and that is successfully returning a non granted result when using Tor.

I recommended revisiting the output claims of your condition axis check technical profile in your B2C policy to ensure you are correctly feeding the result returned by the service and using it to define your next step.

 Please let us know if you require any further assistance we’re happy to help. If you found this information useful, kindly mark this as "Accept Answer".