Azure B2C custom policy Microsoft Live.com Account - Get Picture - azure

Question

I try to get user image for MSA-OIDC TechnicalProfiles, but it's not working.
Somebody will help me? This is my Claims Provider.
For google and facebook this solution working perfectly. I will add that in Azure Ad Application I added permission for User.Read, email, profile. It's enough?
<ClaimsProvider>
<Domain>live.com</Domain>
<DisplayName>Microsoft</DisplayName>
<TechnicalProfiles>
<TechnicalProfile Id="MSA-OIDC">
<DisplayName>Sign in with Microsoft</DisplayName>
<Protocol Name="OpenIdConnect" />
<Metadata>
<Item Key="ProviderName">https://login.live.com</Item>
<Item Key="METADATA">https://login.live.com/.well-known/openid-configuration</Item>
<Item Key="response_types">code</Item>
<Item Key="response_mode">form_post</Item>
<Item Key="scope">openid profile email</Item>
<Item Key="HttpBinding">POST</Item>
<Item Key="UsePolicyInRedirectUri">false</Item>
<Item Key="client_id">************************</Item>
</Metadata>
<CryptographicKeys>
<Key Id="client_secret" StorageReferenceId="B2C_1A_MSASecret" />
</CryptographicKeys>
<OutputClaims>
<OutputClaim ClaimTypeReferenceId="issuerUserId" PartnerClaimType="oid" />
<OutputClaim ClaimTypeReferenceId="givenName" PartnerClaimType="given_name" />
<OutputClaim ClaimTypeReferenceId="surName" PartnerClaimType="family_name" />
<OutputClaim ClaimTypeReferenceId="displayName" PartnerClaimType="name" />
<OutputClaim ClaimTypeReferenceId="authenticationSource" DefaultValue="socialIdpAuthentication" />
<OutputClaim ClaimTypeReferenceId="identityProvider" PartnerClaimType="iss" />
<OutputClaim ClaimTypeReferenceId="email" />
<OutputClaim ClaimTypeReferenceId="picture" PartnerClaimType="picture" />
</OutputClaims>
<OutputClaimsTransformations>
<OutputClaimsTransformation ReferenceId="CreateRandomUPNUserName" />
<OutputClaimsTransformation ReferenceId="CreateUserPrincipalName" />
<OutputClaimsTransformation ReferenceId="CreateAlternativeSecurityId" />
</OutputClaimsTransformations>
<UseTechnicalProfileForSessionManagement ReferenceId="SM-SocialLogin" />
</TechnicalProfile>
</TechnicalProfiles>
</ClaimsProvider>

Answer 1

• I didn’t use the claims provider class as posted by you in the question, but I followed the Github solution as given below in the link and I successfully signed with the Microsoft account through the ‘Signin or Signup’ userflow. Also, I tried to signup using the Identity Experience Framework also through the custom policy and was successful in creating a Microsoft account in Azure AD B2C during signup. Please find the link below for your reference: -
https://github.com/MicrosoftDocs/azure-docs/blob/master/articles/active-directory-b2c/identity-provider-microsoft-account.md
Microsoft account signup option through custom policy used from the above link: -
Also, for getting the profile picture image of Microsoft account in Azure B2C, you will have to already import the profile picture of that user in Azure B2C because there is no way to get the profile photo of a Microsoft account in Azure B2C even through custom policy. Also, please take note of the points in the link below: -
https://learn.microsoft.com/en-us/graph/api/profilephoto-get?view=graph-rest-1.0#to-retrieve-the-profile-photo-of-a-contact
The community thread link below states some probable steps that you can carry out in case of getting the profile user image: -
Get User profile pic using custom policy with azure B2C