Rory Braybrook

Using social federation via native auth in Entra External ID (EEID) The docs are here. Initially, this had me puzzled. I couldn’t find any reference to social federation in the native auth …

Using “Entra Local” with device code flow Read my previous post for the background. The repo is here. Unfortunately, this repo is so old that I don’t have that version of .NET on my PC! This …

Using “Entra Local” with the MSAL libraries The repo is here. Entra Local is “A local, MSAL-compatible emulator of Microsoft Entra ID, for application developers. Entra Local exposes the same …

Some notes on migrating from Azure AD B2C to Entra External ID (EEID) (Part 3) I have written some posts on this — Part 1 and Part 2, and I have posted several articles on what I call the hybrid …

Entra External ID is also called CIAM. The dev. blog is here. The docs. are here. As per the docs., you would use this when: “You want less code to own and manage.Your app’s language and SDKs don’t provide user sign-in or authorization.You don’t have…

Entra ID B2B has two parts to it: External ID for customers (CIAM) B2BEntra ID B2B The confusion exists around the self-service sign-up user flow. Entra ID B2B is the classic B2B where external users are added via an invite. These users have a “User…

Fifty years ago today, I started my career in IT. I was in my second year of university, and my parents lived in Malawi, which had exchange control, so they could only send me K30 a month, which didn’t cover much! Obviously, it went a lot further…

When I first tried this, I got an error that I documented in a post. The answer was to use the Microsoft.Identity.Web samples rather than the MSAL ones. That works, but I couldn’t see any reason why MSAL wouldn't work with CIAM with the correct…

The full error is : AADSTS500208: The domain is not a valid login domain for the account This happens when you create an app. registration in CIAM and use the quick start samples: In my case, I used the .NET Core sample. When you run the sample, you…

This is similar to my previous post. It uses the embedded technique in this sample. Basically, when the user logs in, they pick the guest option, maybe enter some attributes that the application needs and redirect to the application without actually…

This is a use case that I am regularly asked about. The first thing to realise is that because the user is anonymous, they have no identity e.g. no first name, login, password, objectId etc. so you can’t do reads and writes into B2C. You could e.g.…

I’ve been doing a lot of work with custom policies lately and came across a number of things that might help other custom policy developers so I thought it worth while to note them. This article will be updated as I come across other tips and tricks.…

I have organised the series as a list inside Medium so you can see the rest of the series. If you look at the login page, you see a sign up link. If you click the link, you see: The default journey is to verify the email address when you sign up.…

As most of you know, ADAL is being deprecated. “Starting June 30th, 2020, we will no longer add new features to ADAL. We’ll continue adding critical security fixes to ADAL until June 30th, 2022. After this date, your apps using ADAL will continue to…

Googling this shows only one sample and that sample uses WS-Federation not OpenID Connect (OIDC)! There doesn’t appear to be anything else and you can’t use the usual ADAL / MSAL libraries because there aren’t .NET Core versions yet. (There are…

Note: Both these approaches rely on OpenID Connect. They do not cover SAML or WS-Federation. The Microsoft Identity Platform “is an authentication service, open-source libraries, and application management tools”. It is not a product and you can’t…