Azure B2C Auth Request

Question

Hello, we have a scenario where we have policy A without MFA and policy B with MFA. We would want users to use policy A to sign-in, when users want to access the secure areas of the application we want to challenge them with policy B based on some criteria. When there is an active session with policy A, user bypasses the sign-in step in policy B and gets MFA step. When there is no active session, would the users be able to manipulate the Auth Request to change the policy from B to A and skip MFA here. If yes, how can we handle this. Thanks

Answer 1

Hi @Dyasani, Ranjeeth (NonEmp) • Thank you for reaching out.

I understand you want to sign in to your application via B2C user flow/custom policy after successful 1st-factor authentication and then trigger only the 2nd-factor authentication when making API calls to access secure areas of your applications.

In this case, rather than using 2 separate policies, I would suggest you use only one policy and leverage Conditional Access. In the Conditional Access policy, including the app that is exposed as API and configure the CA policy to trigger MFA when API is accessed. On the other hand, as the app is not in the scope of the CA policy, MFA won't be triggered during sign-in to the app.

For your reference, I have created B2C_1_SuSi-Username policy configured with Conditional Access to protect both the App and the API. You can try performing the below steps in the same sequence:

1. SignUp and SignIn to the App (click here).
2. Use the same policy to get a token for the API within the same browser session (click here).

In this case, the App is not included in the CA policy but the API is included. So, MFA will be triggered only for the API and not for the App.

-----------------------------------------------------------------------------------------------------------

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.