MergeBehavior when overriding collection elements in custom B2C Policies - azure-ad-b2c

Question

I am trying to structure my base & ext policies so that base remains pretty static. To do this I am overriding claims, etc in the ext policy - which works well. However, when trying to override a Validation Technical profile, it appears that the new items are being added at the beginning of the collection and not the end as I would have expected.
So if I have this:
base.xml
<TechnicalProfile Id="LocalAccountSignUpWithLogonEmail-NoVerify">
<DisplayName>Email signup</DisplayName>
… <!-- stuff removed for brevity -->
<ValidationTechnicalProfiles>
<ValidationTechnicalProfile ReferenceId="AAD-UserWriteUsingLogonEmail" />
</ValidationTechnicalProfiles>
<UseTechnicalProfileForSessionManagement ReferenceId="SM-AAD" />
</TechnicalProfile>
and this
ext.xml
<TechnicalProfile Id="LocalAccountSignUpWithLogonEmail-NoVerify">
<ValidationTechnicalProfiles>
<ValidationTechnicalProfile ReferenceId="API-UpdateUser" />
<ValidationTechnicalProfile ReferenceId="API-GetUser" />
</ValidationTechnicalProfiles>
</TechnicalProfile>
They execute in the order of
API-UpdateUser
API-GetUser
AAD-UserWriteUsingLogonEmail
Is there anyway to control this order as I need the user to be created before the API stuff executes? i.e. Execute in order 3, 1, 2

Answer 1

From what I have learned, if the override adds an element with the same elementname and ID, it replaces that element from the base policy.
So, if the extension policy contains:
````
<TechnicalProfile Id="LocalAccountSignUpWithLogonEmail-NoVerify">
<ValidationTechnicalProfiles>
<ValidationTechnicalProfile ReferenceId="API-UpdateUser" />
<ValidationTechnicalProfile ReferenceId="API-GetUser" />
<ValidationTechnicalProfile ReferenceId="AAD-UserWriteUsingLogonEmail" />
</ValidationTechnicalProfiles>
</TechnicalProfile>
````
then "AAD-UserWriteUsingLogonEmail" won't be invoked 2 times, it will be invoked once, as third validation profile, because the referenceId="AAD-UserWriteUsingLogonEmail" overrides the declaration of that element in the base policy file.
The documentation is not very clear about this, and the closest doc I have found is in https://github.com/Azure-Samples/active-directory-b2c-advanced-policies/blob/master/Documentation/Features%20part%206.md, where it says:
Same element in the child policy and parent policy implies, child
policy is overriding that element of the parent policy
That documentation doesn't make clear what "same element" means, it seems to me to be the same XPath and same ID (with the ID being whatever attribute is the unique id of the element).

Answer 2

You need to overwrite all of them in the correct order in the extension policy. For example, if your base policy has following validation technical profile AAD-UserWriteUsingLogonEmail
In the extension policy, you add AAD-UserWriteUsingLogonEmail again, in the correct order:
API-UpdateUser
API-GetUser
AAD-UserWriteUsingLogonEmail