Verifying AD Tenant MFA in a B2C Policy

Question

I am currently trying to wrap my head around an issue.

I have a B2C tenant set up with custom policies that uses a multi tenant AD connection as described in the MS docs here: identity-provider-azure-ad-multi-tenant.
In turn, I have connected the B2C tenant to a PowerApps Portal as instructed here: configure-azure-ad-b2c-provider.

I know I can setup MFA in the custom policy to make sure that users signing up and signing in are forced to use MFA.
What I want however is to check if the AD users signing up and signing in already have MFA setup on their AD account or not.
If I can do that in my B2C custom policy, I can make sure that we only let in users who have setup MFA in their AD tenant while at the same time preventing users from having to use MFA twice when signing up/signing in to the B2C tenant (once in their AD and once in my B2C).

I would then need a form of conditional access in which I would only allow signup/signin for users who have MFA setup in their AD tenant and blocking users when they dont.

I know that in OpenID Connect there is an amr claim that I can add to the ID Token but as far as I can tell this claim is not available to be used/read in B2C (and so I can't add this claim to the claimsbag in my custom policy). I am aware of this long running thread on Github, regarding the lack of an amr claim in the Microsoft Identity Platform. I am not entirely sure yet if this means B2C can't read/display this claim in a token though.

I cannot imagine that the only option would be to enforce MFA in the B2C for all AD users seeing as though for most of those users this would mean that they would be prompted for MFA twice in a row when signing up/signing in.

Any help/advice regarding this subject would be very much appreciated.

Answer 1

@Sander Koster • Thank you for reaching out.

I tested this scenario in my B2C tenant and below are the steps that I performed to achieve it.

The amr claim is available only in V1 token, so I used the V1 OIDC metadata endpoint in my technical profile for Federated AAD and captured amr claim in this technical profile. I then created a Claims Transformation to set extension_AadMfaDone to true if the amr claim contains mfa in its array. Finally, skipped the MFA orchestration steps if extension_AadMfaDone is True (capital T as it is boolean and not a string).

• Add the below claims to your custom policy:

    <ClaimType Id="extension_amr">  
       <DisplayName>amr</DisplayName>  
       <DataType>stringCollection</DataType>  
       <UserHelpText/>  
     </ClaimType>  
  
    <ClaimType Id="extension_AadMfaDone">  
       <DisplayName>AadMfaDone</DisplayName>  
       <DataType>boolean</DataType>  
       <UserHelpText/>  
     </ClaimType>  
  

• Add below claims transformation:

   <ClaimsTransformation Id="CheckIfAadMfaIsDone" TransformationMethod="StringCollectionContains">  
     <InputClaims>  
       <InputClaim ClaimTypeReferenceId="extension_amr" TransformationClaimType="inputClaim"/>  
     </InputClaims>  
     <InputParameters>  
       <InputParameter  Id="item" DataType="string" Value="mfa"/>  
       <InputParameter  Id="ignoreCase" DataType="string" Value="true"/>  
     </InputParameters>  
     <OutputClaims>  
       <OutputClaim ClaimTypeReferenceId="extension_AadMfaDone" TransformationClaimType="outputClaim"/>  
     </OutputClaims>  
   </ClaimsTransformation>  
  

• Update the below parameters under the technical profile that you have added for your federated Azure AD tenant:

             1. Remove v2.0 from the OIDC Metadata URL so that you get V1 token as V2 token does NOT include the amr claim.  
                      <Item Key="METADATA">https://login.microsoftonline.com/your_tenant.onmicrosoft.com/.well-known/openid-configuration</Item>  
  
           2. Add below output claims under the <OutputClaims> of your technical profile:  
                      <OutputClaim ClaimTypeReferenceId="extension_amr" PartnerClaimType="amr" />  
                      <OutputClaim ClaimTypeReferenceId="extension_AadMfaDone"/>  
  
           3. Add below Output Claim Transformation under <OutputClaimsTransformations> of your technical profile:  
                      <OutputClaimsTransformation ReferenceId="CheckIfAadMfaIsDone"/>  
  

• Skip the MFA orchestration steps if extension_AadMfaDone = true as shown below:

       <OrchestrationStep Order="7" Type="ClaimsExchange">  
         <Preconditions>  
           <Precondition Type="ClaimsExist" ExecuteActionsIf="true">  
             <Value>isActiveMFASession</Value>  
             <Action>SkipThisOrchestrationStep</Action>  
           </Precondition>  
  

  <Precondition Type="ClaimEquals" ExecuteActionsIf="true">
  <Value>extension_AadMfaDone</Value>
  <Value>True</Value>
  <Action>SkipThisOrchestrationStep</Action>
  </Precondition>
  </Preconditions>
  <ClaimsExchanges>
  <ClaimsExchange Id="PhoneFactor-Verify" TechnicalProfileReferenceId="PhoneFactor-InputOrVerify" />
  </ClaimsExchanges>
  </OrchestrationStep>

       <OrchestrationStep Order="8" Type="ClaimsExchange">  
         <Preconditions>  
           <Precondition Type="ClaimsExist" ExecuteActionsIf="false">  
             <Value>newPhoneNumberEntered</Value>  
             <Action>SkipThisOrchestrationStep</Action>  
           </Precondition>  
  

  <Precondition Type="ClaimEquals" ExecuteActionsIf="true">
  <Value>extension_AadMfaDone</Value>
  <Value>True</Value>
  <Action>SkipThisOrchestrationStep</Action>
  </Precondition>
  </Preconditions>
  <ClaimsExchanges>
  <ClaimsExchange Id="AADUserWriteWithObjectId" TechnicalProfileReferenceId="AAD-UserWritePhoneNumberUsingObjectId" />
  </ClaimsExchanges>
  </OrchestrationStep>

-----------------------------------------------------------------------------------------------------------

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

Answer 2

Hello @AmanpreetSingh-MSFT ,
I would like to know how to implement Multi-Factor Authentication (MFA) in a multi-tenant sign-in approach. Additionally, could you please clarify in which file I should add the mentioned claim type?