How to avoid adding Externally Authenticated users to our B2C directory - azure-ad-b2c

Question

We are trying to configure a Custom Policy in AAD B2C that will allow certain users to login via their companies SSO Provider. The Provider is Ping. Using SAML 2.0. Everything is working fine, but after the user successfully logs in to Ping, they are required to be added to the local B2C directory. We don't want these user's in our B2C directory. Is there a way to avoid this?
<ClaimsProvider>
<Domain>Ping</Domain>
<DisplayName>Ping Login</DisplayName>
<TechnicalProfiles>
<TechnicalProfile Id="Ping-SAML">
<DisplayName>Sign in to Ping</DisplayName>
<Description>Login with your Ping account</Description>
<Protocol Name="SAML2"/>
<Metadata>
<Item Key="WantsEncryptedAssertions">false</Item>
<Item Key="WantsSignedAssertions">false</Item>
<Item Key="PartnerEntity">URL FOR FB2C_1A_TrustFrameworkBase</Item>
</Metadata>
<CryptographicKeys>
<Key Id="SamlAssertionSigning" StorageReferenceId="B2C_1A_PingSamlCert"/>
<Key Id="SamlMessageSigning" StorageReferenceId="B2C_1A_PingCert"/>
<Key Id="SamlAssertionDecryption" StorageReferenceId="B2C_1A_PingCert" />
</CryptographicKeys>
<OutputClaims>
<OutputClaim ClaimTypeReferenceId="socialIdpUserId" PartnerClaimType="uid"/>
<OutputClaim ClaimTypeReferenceId="tenantId" PartnerClaimType="tid"/>
<OutputClaim ClaimTypeReferenceId="givenName" PartnerClaimType="fname"/>
<OutputClaim ClaimTypeReferenceId="surname" PartnerClaimType="lname"/>
<OutputClaim ClaimTypeReferenceId="identityProvider" DefaultValue="Ping.com" />
<OutputClaim ClaimTypeReferenceId="authenticationSource" DefaultValue="socialIdpAuthentication"/>
</OutputClaims>
<OutputClaimsTransformations>
<OutputClaimsTransformation ReferenceId="CreateDisplayName"/>
<OutputClaimsTransformation ReferenceId="CreateEmail"/>
<OutputClaimsTransformation ReferenceId="CreateRandomUPNUserName"/>
<OutputClaimsTransformation ReferenceId="CreateUserPrincipalName"/>
<OutputClaimsTransformation ReferenceId="CreateAlternativeSecurityId"/>
<OutputClaimsTransformation ReferenceId="CreateSubjectClaimFromAlternativeSecurityId"/>
</OutputClaimsTransformations>
<UseTechnicalProfileForSessionManagement ReferenceId="SM-Noop"/>
</TechnicalProfile>
</TechnicalProfiles>
</ClaimsProvider>
<UserJourney Id="SignUpOrSignInPing">
<OrchestrationSteps>
<OrchestrationStep Order="1" Type="CombinedSignInAndSignUp" ContentDefinitionReferenceId="api.signuporsignin">
<ClaimsProviderSelections>
<ClaimsProviderSelection TargetClaimsExchangeId="PingExchange" />
</ClaimsProviderSelections>
</OrchestrationStep>
<OrchestrationStep Order="2" Type="ClaimsExchange">
<ClaimsExchanges>
<ClaimsExchange Id="PingExchange" TechnicalProfileReferenceId="Ping-SAML" />
</ClaimsExchanges>
</OrchestrationStep>
<OrchestrationStep Order="3" Type="SendClaims" CpimIssuerTechnicalProfileReferenceId="JwtIssuer" />
</OrchestrationSteps>
<ClientDefinition ReferenceId="DefaultWeb" />
</UserJourney>

Answer 1

Using a custom policy, you can pass an external identity through, without creating a reference user for it in the Azure AD B2C tenant.
Example:
<UserJourney Id="SignIn">
<OrchestrationSteps>
<OrchestrationStep Order="1" Type="CombinedSignInAndSignUp" ContentDefinitionReferenceId="api.signuporsignin">
<ClaimsProviderSelections>
<ClaimsProviderSelection TargetClaimsExchangeId="PingExchange" />
</ClaimsProviderSelections>
</OrchestrationStep>
<OrchestrationStep Order="2" Type="ClaimsExchange">
<ClaimsExchanges>
<ClaimsExchange Id="PingExchange" TechnicalProfileReferenceId="PingProfile" />
</ClaimsExchanges>
</OrchestrationStep>
<OrchestrationStep Order="3" Type="SendClaims" CpimIssuerTechnicalProfileReferenceId="JwtIssuer" />
</OrchestrationSteps>
</UserJourney>
You might need to generate Azure AD B2C's objectId claim from Ping's issued claims in the PingProfile technical profile, so that Azure AD B2C's JWT issuer can include this objectId claim in a refresh token, if one is issued to your Azure AD B2C application.