Rory Braybrook

Issue with migrating users with a password from Azure AD B2C to Entra External ID using OTP In this Microsoft YouTube video around “External ID JIT migration”, one of the suggestions is that when …

Some notes on migrating from Azure AD B2C to Entra External ID (EEID) (Part 3) I have written some posts on this — Part 1 and Part 2, and I have posted several articles on what I call the hybrid …

Customising your Password Reset emails with the “Email Otp Send” custom authentication extension in Entra External ID (EEID) The docs. are here. See also my previous post on custom authentication …

Augmenting sign-up attributes with the Attribute Collection Submit custom authentication extension in Entra External ID (EEID) The docs. are here. See my previous post on custom emails. We will mock …

Augmenting sign-up attributes with the “Attribute Collection Start” custom authentication extension in Entra External ID (EEID) The docs. are here. See my previous post on custom emails. We will …

Augmenting the JWT with the “Token Issuance Start” custom authentication extension in Entra External ID (EEID) To augment the token, we use the token issuance start event. “The token issuance …

Enabling SMS as an MFA method in Entra External ID Entra External ID supports SMS MFA, but only for second factor. “External tenants support two methods for authentication as a second factor: Email …

Using Lokka with MCP and Claude to manage extension attributes in Azure AD B2C Lokka is “a simple yet powerful middleware that connects AI language models (like ChatGPT or Claude) to your Azure and …

Some notes on migrating from Azure AD B2C to Entra External ID (EEID) (Part 2) The part 1 post is here. Read that first, as it covers most of the basics. I have posted several articles on this hybrid …

Note that this does not cater for passwords. You will need to give each user a random password. The user will not be aware of their password. Note: This approach does not migrate social users since…

The reason is that “when you verify an email address for TOTP in Entra External ID, the email address does not appear in the 'Authentication Methods' tab as email is not considered a dedicated MFA…

The full description is:

The custom policy uses Entra External ID (EEID) as the DB rather than B2C, which makes migration much easier at some point. It’s a combination of “issuerUserId” and “identityProvider”, both found in…

To get a list of extension attributes, such as extension_abc, used in custom policies, you need to get the client ID and object ID of the B2C extension app. You can get a basic set of attributes with…

I was trying to figure out how to validate the JWT signature, not realising the rabbit hole I was about to enter. This long thread provides an example of checking the access token signature (or…

The function calls are not protected. In the real world, the “auth” call returns an access token, which the application passes back to, e.g. the “read” function, which checks the token’s validity…

You use B2C custom policies so you have access to the workflows, but you replace the B2C API with Graph calls to an Azure function that calls Entra External ID (EEID). As I was only interested in…

Entra External ID can currently be used as a SAML SP but not as an IDP.. “Connecting Entra External ID as an SP to Azure AD B2C via SAML” is published by Rory Braybrook in The new control plane.

As per the documentation, you can use the custom policies from the B2C starter pack and then add an extra claim to the SUSI custom policy: In B2C, configure an app. registration, note the client ID…

On the Entra External ID side (as per the docs.), I created a user flow and added Kinde as an Identity provider: If you encounter any errors here, refer to this post, where I document the common…