Azure b2c | Sign In User flow | Prevent b2c user to update user/custom attributes

Question

My application utilizes Azure b2c to handle authentication and authorization. Users are created by backend service via Graph API, and only enable Sign In User Flow with some attributes return in application claim. During user creation process, some user attributes and custom attribute "Role" will be assign value, these attributes will be use by backend service for access control.

As my application rely on user attributes(claims) in token for access control, these attributes should not be modify by user. Although Sign In User Flow does not collect user attributes, but I am not sure is any other ways for user to modify attributes.

How to prevent b2c user update attributes ?

Answer 1

Hi @Sen Hui Lim ,

Thanks for adding more context. If you are only using a Sign In flow, consumer b2c accounts cannot modify their attributes, as the policy prevents it. That is why we have a "Profile edit" flow. Also, those consumer accounts cannot sign in into the Entra ID Portal/Azure Portal.

Hope this clarifies.

Answer 2

Hi @Sen Hui Lim ,

To add to the previous comments, you would need to add the user in the role of External ID User Flow Attribute Administrator to allow the creation of the custom attributes. Users with the role of "External ID User Flow Attribute Administrator" can add or delete custom attributes available to all user flows in the tenant.  As such, users with this role can change or add new elements to the end user schema and impact the behavior of all user flows and indirectly result in changes to what data may be asked of end users and ultimately sent as claims to applications. 

If you add the user to above role then they should be able to create the custom attributes. Otherwise I believe they would lack the permissions you are describing. Please feel free to add more context though if I am missing something.