We are using signup/signin builtin user flow and want to combine the "forgot password" part into this flow though sspr https://learn.microsoft.com/en-us/azure/active-directory-b2c/add-password-reset-policy?pivots=b2c-user-flow#self-service-password-reset-recommended
However, the sspr bottun unable to click in user flow property and show a line at the bottom "sspr currently unavailable to support combind local account", am I using the wrong account or APIM needs to do some conf?
I have searched a while and there is no similar case. Has anyone encountered the same problem?
Please check if below are the causes:
Note : In a sign-up and sign-in journey, a user can reset their own
password by using the Forgot your password link. This ability to
reset passwords only apply to local accounts in Azure Active Directory
B2C (Azure AD B2C) i.e; you can only reset your password if you
signed up using an email address or a username with a password for
sign-in .
In case of azure ad, users of SSPR requires one of the following licenses: Azure AD
Premium P1 or P2, Microsoft 365 Business, or Office 365. If you have
a hybrid environment, you also need password writeback into your
on-premises AD. In this case, you’ll need Azure AD Premium P1 or P2
or Microsoft 365 Business.
You may not be able to see password reset menu option if you don't have an Azure
AD license assigned to the administrator performing the operation.
Please check out below references:
Troubleshoot self-service password reset - Azure Active Directory | Microsoft Docs
Frequently asked questions (FAQ) for Azure Active Directory B2C | Microsoft Docs
Azure AD B2C Password Reset - Stack Overflow
Related
I am using AzureAD. And I am implementing MFA.
I know that if the user ID and password login fails a certain number of times, it locks me out.
However, repeated failures in MFA after passing user ID and password authentication will not lock out the user.
Repeated failures on the MFA screen will return you to the initial login screen.
Is this a specification?
If it is possible to lock out even with MFA, please let me know how.
Yes, lockout feature is available in Azure AD MFA. Please note that this feature is applied only when the users use PIN code for the MFA prompt.
In order to configure this feature, you need administrator role.
Based on the number of failure trials you provided in settings, account lockout happens respectively.
To configure this feature, please follow below steps:
Go to Azure Portal -> Azure Active Directory -> Security -> Multifactor authentication -> Account lockout
In the above fields, enter the number based on your requirement and Save.
Like this, you can configure lockout feature in Azure AD MFA.
Make sure to use PIN for MFA authentication.
Complete credits to below Microsoft Doc:
Configure Azure AD Multi-Factor Authentication - Azure Active Directory - Microsoft Entra | Microsoft Docs
I have configured identity provider as described in this documentation
Sign up page shows up as in the photo. When entering existing office 365 email address, it doesn't accept. It only accepts personal Microsoft accounts.
Found an old feature request what was declined.
https://feedback.azure.com/forums/169401-azure-active-directory/suggestions/16849006-aadb2c-integrate-office-365-to-work-with-b2c
Is it still the same OR is there any alternate way ?
Update (couldnt page photo in comment, updating the question)
I chose 2nd option for multi-tenancy from suggestion and now it gives me error
The account needs to be added as an external user in the tenant first. Sign out and sign in again with a different Azure Active Directory user account.
If you want any O365 Account to sign in to your AAD B2C protected app, you need to federate with AAD Multi Tenant using Custom Policies.
https://learn.microsoft.com/en-gb/azure/active-directory-b2c/identity-provider-azure-ad-multi-tenant-custom?tabs=app-reg-ga
Set up sign-up and sign-in with a Microsoft account using Azure Active Directory B2C is only for personal Microsoft accounts.
You should configure Azure AD IDP by following Set up sign-in for a specific Azure Active Directory organization in Azure Active Directory B2C.
Then you can use existing office 365 account to sign in.
The temporary password from the Azure portal when you manually reset a user password does not seem to work on the "Sign in v2" user flow, it does, however, work on the "Sign in" user flow.
I assume this is a bug since the v2 flow is still in preview.
Both user flows are under the same domain.
Is this a known issue? I was not able to find any information in the fast-developing Azure world.
The password reset through Azure Portal against a B2C Local Account is not supported for any flow, except the old Sign In flow. This is referred to as ForceChangePassword.
At the moment Azure AD B2C are not available in all regions. So , If I create Azure AD B2C in a region where it is available, is it possible me to migrate users later into a new Azure AD B2C, which will be created in my region when the Azure AD B2C available in the region?
p.s. copy of https://social.technet.microsoft.com/Forums/en-US/7e42bb1a-7a04-4a62-9864-5c7392f790cf/migrating-azure-ad-b2c-users-from-region-to-region?forum=paas
Currently there is no information from Microsoft as whether they will provide a native export feature within B2C to allow migration between regions. However you can export users between B2C tenants using GraphAPI as per this guide. One issue with this method for local accounts is that passwords cannot be migrated out of a B2C tenant, so you have two options:
Password Reset - You force every user to perform a password reset whether that be via an email sent to every user, or when a user tries to sign in for the first time.
Validate against old tenant - You modify your sign in policy on the new tenant to verify the users email and password combo against the old tenant via a REST API technical profile. If valid you then write the password to the new tenant.
I have used Azure AD B2C sign-in and sign-up policy for user login and signup process with Multi factor Authentication. Also set password resetting policy.
Everything is working fine with Phone factor (MFA).
Now client wants to add security questions while signing up a user and password resetting.
I have enabled security question and selected 5 questions; however, it's not visible while signing up a user and password resetting.
I am not able to understand what is the exact problem.
Based on the official documentation, Azure AD B2C only supports using a verified email address as a recovery method.
Currently, we only support using a verified email address as a
recovery method. We will add additional recovery methods (verified
phone number, security questions, etc.) in the future.
In addition, Azure AD B2C only supports phone call and text message verification for Multi-Factor Authentication(MFA).
Azure Active Directory (Azure AD) B2C integrates directly with Azure
Multi-Factor Authentication so that you can add a second layer of
security to sign-up and sign-in experiences in your consumer-facing
applications. And you can do this without writing a single line of
code. Currently we support phone call and text message verification.
More information about MFA and password reset for Azure AD B2C, please refer to the following links.
Azure Active Directory B2C: Set up self-service password reset for
your consumers
Azure Active Directory B2C: Enable Multi-Factor
Authentication in your consumer-facing applications