Azure B2B on-behalf flow

Question

Azure B2B on-behalf flow

Hi All,

We were thinking on using Azure B2C but we ran into limitation where B2C does not support on-behalf of flow. API generating token on users behalf is very critical for some integrations. Since B2B can also store external users, i would like to know:

Is it a good strategy to store external user in B2B?
Will B2B support on-behalf of flow?

Any other suggestion that would allow us to use Azure B2C but support on-behalf flow?

Answer 1

Saurabh Sharma 17,326 Microsoft Employee

Yes, On-behalf of flow is supported for guest users but you need to keep in mind that the guest accounts work for single tenant applications only. Please refer to the documentation - Who can sign in. I also recommend you to refer to the Compare B2B collaboration and B2C in Azure AD documentation to learn more about applying appropriate features to your external identity scenarios.

(Please don't forget to accept helpful replies as answer)

Rahul Metangale 101 Reputation points

2020-06-03T05:55:46.113+00:00
Thank you Saurabh for your quick response.

I went through the links you shared and here is what i understood please confirm if this is correct:

If guest users are going to use personal accounts, like Microsoft, gmail, Facebook etc then any applications developed for those users i will have to use Microsoft identity platform end point

For internal organizational users stored in same AD, and application specifically developed for internal users, we will have a choice between v1.0 and Identity platform. So we can use any but recommended approach is use Identity platform

Azure B2B support all the OAuth flows like on behalf and other that are supported by AD and B2C correct?

any security issue that i should be aware of if we use B2B instead of B2C for external users? Since external users are part of the Azure AD tenant rather than separate tenant like B2C has? or any documentation that you can suggest which can answer this question?

Thanks,
Rahul
Saurabh Sharma 17,326 Reputation points Microsoft Employee

2020-06-09T19:28:29.097+00:00
@Rahul Metangale Here are answers to your questions -

No, I think you are a bit confused. If you are talking about guest users then it is supported by V1.0 endpoint as well. However, Microsoft Identity platform allows users to use their
personal accounts to sign in. Users do not need to be a guest user of the tenant to use this end point.

yes, that is correct.

yes, you can also refer to Scenarios and supported authentication flows documentation for details.

I think you can refer to Microsoft identity platform best practices and recommendations which can help you guide for a secure Azure AD integration.

(Please don't forget to accept helpful replies as answer)

Azure B2B on-behalf flow

0 additional answers

Activity