Azure B2C Multi-Tenant SSO: Microsoft work or school account

Anonymous
2020-09-10T16:34:14.637+00:00

I have a Azure B2C instance configured to manage authentication for my web service. When I try and add an Identity provider using a Microsoft Account following these instructions https://learn.microsoft.com/en-us/azure/active-directory-b2c/identity-provider-microsoft-account, It will only allow the user to use a personal account to sign in. I would like for the user to be able to use a work or school account to sign in as well.

I have tried these instructions for multi-tenant https://learn.microsoft.com/en-us/azure/active-directory-b2c/identity-provider-azure-ad-multi-tenant-custom?tabs=app-reg-ga. But when I try to create the custom IDP, I get the following error message:

"The Metadata Endpoint 'https://login.microsoftonline.com/common/v2.0/.well-known/openid-configuration' is not an allowed endpoint."

I just want to be able to give the user to choose any Microsoft account to login. Similar to how I signed up for this learn.microsoft.com, where it let me choose from personal or my work accounts.

Microsoft Entra External ID
Microsoft Entra External ID
A modern identity solution for securing access to customer, citizen and partner-facing apps and services. It is the converged platform of Azure AD External Identities B2B and B2C. Replaces Azure Active Directory External Identities.
2,644 questions
0 comments

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Michael Washington 911 Reputation points MVP
    2020-09-14T04:40:14.913+00:00

    It is a lot of careful steps and configuration, but, it does work:

    To use Custom Policies, the first step is to complete all the steps described here:

    Get started with custom policies - Azure AD B2C | Microsoft Learn

    Then complete the steps described here:

    Set up sign-in for multi-tenant Azure AD by custom policies - Azure AD B2C | Microsoft Learn

    I detailed my experience in this Blog post:

    Blazor Multi-Tenant Azure B2C

    2 people found this answer helpful.
    0 comments
  2. Alfredo Revilla - Senior Freelance SWE, SWA, IAM 27,096 Reputation points
    2020-09-10T22:30:36.897+00:00

    User flows do not support multi-tenant Azure AD identity providers. You might try with custom policies but choosing Accounts in any organizational directory (Any Azure AD directory - Multitenant) and personal Microsoft accounts (e.g. Skype, Xbox) instead of Accounts in any organizational directory (Any Azure AD directory - Multitenant) in step 6 of Register an application.

    --
    Please let us know if this answer was helpful to you. If so, please remember to mark it as the answer so that others in the community with similar questions can more easily find a solution.

    1 person found this answer helpful.
    0 comments