Rory Braybrook

Analysing Azure AD B2C custom policies to aid with migration to Entra External ID (EEID) The docs are here. “The Migration Policy Analyzer is available directly in your Azure AD B2C tenant. It …

Azure AD B2C to Entra External ID (EEID) migration tools The tooling docs for B2C migration are here. There is now a whole set of tools to help you with your migration. In addition, EEID has new …

Using the High Scale Compatibility (HSC) mode in Entra External ID (EEID) for enabling Azure AD B2C migration The docs are here and here. A picture is worth a thousand words: or a later one: Both B2C …

Creating a feature flag in Azure AD B2C I was asked this question by a customer. They wanted to test a new feature and needed a feature flag to turn it off if need be, without changing or uploading …

Using the ROPC flow with Azure AD B2C Yes, I know it’s not secure, but that’s not the point of this article 😃 Back in the day (actually 2018!), I wrote a post about this, and it worked. The …

Using the GitHub Spec Kit to compare the features in Azure AD B2C and Entra External ID The docs. are here, and the introductory video is here. Note that this is not a deep dive into …

Using PowerShell 7 with Entra External ID (EEID) to link identities Note: I used vibe coding to create some of the script. Using AI can produce errors, so use the script at your own risk! My previous …

Some notes on migrating from Azure AD B2C to Entra External ID (EEID) (Part 3) I have written some posts on this — Part 1 and Part 2, and I have posted several articles on what I call the hybrid …

Some notes on migrating from Azure AD B2C to Entra External ID (EEID) (Part 2) The part 1 post is here. Read that first, as it covers most of the basics. I have posted several articles on this hybrid …

These are difficult to test. They could be triggered by logging in from a banned country (needs a VPN), using the TOR browser (not allowed on many work PC), or other similar methods…

The way it works is that CA uses Identity Protection to generate signals based on the type of login and user. Before you start, you need to tell CA what “AuthenticationMethodUsed” is set to, based on…

Azure AD B2C error “80131500” “Invalid username or password”. Normally, this is because you have used the wrong client_id in the extension custom policy..

Note that this does not cater for passwords. You will need to give each user a random password. The user will not be aware of their password. Note: This approach does not migrate social users since…

Note that this code is not production-ready, so use it at your own risk!. “Provisioning user MFA programatically in Azure AD B2C” is published by Rory Braybrook in The new control plane.

The custom policy uses Entra External ID (EEID) as the DB rather than B2C, which makes migration much easier at some point. It’s a combination of “issuerUserId” and “identityProvider”, both found in…

The error is:

To get a list of extension attributes, such as extension_abc, used in custom policies, you need to get the client ID and object ID of the B2C extension app. You can get a basic set of attributes with…

The function calls are not protected. In the real world, the “auth” call returns an access token, which the application passes back to, e.g. the “read” function, which checks the token’s validity…

You use B2C custom policies so you have access to the workflows, but you replace the B2C API with Graph calls to an Azure function that calls Entra External ID (EEID). As I was only interested in…

Remember that client credentials have the context of an application, not that of a user, so that no user attributes can be mapped. After some research, I found that the “sub” is the app's service…