Azure B2C multitenant login

Question

While setting up sign-in for multi-tenant Azure Active Directory using custom policies in Azure Active Directory B2C, it requires generating a client secret while registering the app in Azure AD tenant.

As per the best practice, its good to have this secret rotated frequently but when it comes to implementing this in B2C (for PROD environment) what's the recommendation for rotating secrets ?

Also, do we need to rotate IEF keys ie. TokenSigningKeyContainer and TokenEncryptionKeyContainer as the MS documentation does not state that these keys need to be rotated.

Thanks

Answer 1

Hi @robcool • Thank you for reaching out.

In Azure AD B2C, you can roll over the keys periodically, or immediately in case of emergency for security purposes, The rollover frequency may vary depending on each organization's individual policy.

An Azure AD B2C key container can contain multiple keys. You can use the option highlighted below for this purpose. For auto rollover, you must set only one of those keys as active at any one point in time. When the current key's expiration time has elapsed and the key container contains a new key with valid not before and expiration times, the new key will become active automatically.

Read More: Azure AD B2C Key Rollover

-----------------------------------------------------------------------------------------------------------

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.