Configuring Azure AD B2C for login

Azure Active Directory B2C (Azure AD B2C) is an identity management service that enables secure access to applications by allowing users to log in with social or enterprise identities. When integrated with Power Pages, Azure AD B2C helps you create customer-facing websites with flexible authentication options such as Microsoft, Google, Facebook, and local accounts.

This detailed guide will walk you through the complete configuration process of Azure AD B2C login in Power Pages, including tenant setup, app registration, user flow configuration, portal setup, and best practices.

---

1. What is Azure AD B2C?

Azure AD B2C is a cloud identity service for external users. Unlike Azure AD, which is designed for organizational (internal) identities, B2C is built for customer identity access management (CIAM). It supports OpenID Connect, OAuth 2.0, and custom identity providers.

In Power Pages, Azure AD B2C enables:

• Sign-in using social accounts (Google, Facebook, LinkedIn).
• Local username/password accounts.
• Multi-Factor Authentication (MFA).
• Profile management and password reset.

---

2. Pre-requisites

Before starting, ensure you have:

• An Azure subscription
• Access to the Azure AD B2C tenant
• Permissions to register applications in the B2C tenant
• A Power Pages portal provisioned and ready

---

3. Step-by-Step Configuration

---

Step 1: Create or Link Azure AD B2C Tenant

1. Sign in to Azure Portal.
2. Search for Azure AD B2C in the search bar.
3. Click Create a new Azure AD B2C tenant or link an existing one.
4. After creating, click Switch to the B2C directory using the directory switcher in the top-right corner.

---

Step 2: Register Power Pages as an Application

1. In the Azure AD B2C tenant, go to App registrations.
2. Click + New registration.
3. Enter the following:
   • Name: e.g., PowerPagesAuthApp
   • Supported account types: Accounts in this organizational directory only
   • Redirect URI (web):
     https://<yourportal>.powerappsportals.com/signin-aadb2c
4. Click Register.
5. After registration, copy the Application (client) ID and Directory (tenant) ID for later use.

---

Step 3: Generate Client Secret

1. Open your registered app.
2. Go to Certificates & secrets → + New client secret.
3. Add a description and expiration period.
4. Copy the Value of the generated secret – it’s needed later.

---

Step 4: Configure API Permissions

1. Go to the app’s API permissions section.
2. Add permissions:
   • Microsoft Graph → openid, email, profile, offline_access
3. Click Grant admin consent for the tenant.

---

Step 5: Create User Flows in B2C

1. Go to User Flows in the Azure AD B2C blade.
2. Create flows for:
   • Sign-up and sign-in (recommended to combine)
   • Password reset
   • Profile editing (optional)
3. For each flow:
   • Set identity providers (local or social)
   • Set user attributes to collect (e.g., email, display name)

Copy the user flow name for later reference.

---

Step 6: Add Identity Providers (Optional)

To enable Google, Facebook, or other social logins:

1. Go to Identity Providers in B2C.
2. Choose your provider (e.g., Google).
3. Register an app with that provider to get Client ID and Secret.
4. Fill these values into the B2C setup.
5. Add the provider to the desired user flow.

---

Step 7: Configure Power Pages with Azure AD B2C

Now, integrate the B2C setup into your Power Pages portal.

Option 1: Use Design Studio

1. Open your Power Pages portal.
2. Navigate to Set up → Identity providers.
3. Click Add identity provider → Choose Azure AD B2C.
4. Enter the required information:
   • Name: AzureADB2C
   • Authority:
     https://<your-tenant-name>.b2clogin.com/<tenant-id>/<user-flow-name>/v2.0
   • Client ID: From the B2C App
   • Client Secret: Created in Step 3
   • Redirect URI:
     https://<yourportal>.powerappsportals.com/signin-aadb2c
   • Response type: code
   • Scopes: openid profile email
5. Save and publish.

Option 2: Use Portal Management App

1. Go to Portal Management App (via Power Apps).
2. Navigate to Identity Providers.
3. Create a new provider with:
   • Type: OpenIdConnect
   • Name: AzureADB2C
   • Authority: Same as above
   • Client ID / Secret / Redirect URI
   • Login Button Label: Login with B2C
   • External Login Policy: user flow name
4. Save and restart the portal.

---

Step 8: Test the Login Experience

1. Open your Power Pages portal.
2. Click Sign In.
3. You should see a “Login with B2C” option.
4. Click and it will redirect you to the B2C login page.
5. Authenticate using a local or social account.
6. If successful, you’re redirected back to the portal.

---

4. Managing Users in Power Pages

• When a new user logs in, a Contact is created in Dataverse.
• Assign Web Roles to users for access control.
• You can automate role assignment using Power Automate based on email domain or other attributes.

---

5. Best Practices

• Enable CAPTCHA and Multi-Factor Authentication (MFA) in B2C flows.
• Use custom branding in B2C login pages to match your website.
• Restrict access by Web Roles in Power Pages.
• Ensure that all user attributes needed in Dataverse (like name and email) are included in the B2C user flow.
• Regularly rotate the client secret.

---

6. Troubleshooting

Issue	Solution
Redirect URI mismatch	Double-check the redirect URI in Azure and Power Pages
Login button not visible	Ensure Identity Provider is enabled in Site Settings
Claims missing	Add missing attributes in the user flow
Users not created in Dataverse	Check if the claims include email and sub
Error: AADB2C90047	Likely a configuration error in user flow or authority URL