Add account Id during registration using Azure AD B2C

Question

When a new user registers in my ASP.NET Core app, I need to create a new "organization account" for the user as well as a "user account". I want Azure AD B2C to handle the user account but I want to handle the organization account in my backend.

The organization account allows multiple users to share an account. The process could be as simple as sending Azure AD B2C the new GUID value I'll be using for the account. I want this account Id to be included in the JWT token claims.

How do I pass this account Id to Azure AD B2C? It's important that I pass the account Id to Azure AD B2C because I can use that approach while handling adding new users to an existing organization account.

So, how do I pass some values from my backend to Azure AD B2C during user registration?

P.S. I want to further clarify the process of adding a new user to an existing organization account. The organization account admin sends an invite to another user. This invitation will allow me to pull the existing account Id and pass it along to Azure AD B2C so that in the JWT token, the account Id can be included. It would be nice to add the organization account name as well e.g. AccountName: Acme, Inc. and AccountId: 7f6818d9-4167-4a57-99ee-2f313a230a7b

Answer 1

You can send claims to B2C by creating your own JWT. Unfortunately, there's no official guide on this process. And it also requires you to use Custom Policies.

• WingTip games custom policy
• Start of source code to send claims to B2C

Reference: Require Input Claims From JWT From RelyingParty in Azure AD B2C

Answer 2

Unfortunately, there is no supported way to send any claims (such as an account ID) to Azure AD B2C when you send a request. It is certainly in the backlog but there's no timeline yet on when it might be available.

There can be a few alternatives though using custom policies, not sure if any of these will be useful.

1) Create the user account in Azure AD B2C tenant using the email address at which invite is set at the time of invitation. At that time, you can add AccountId and AccountName in extension properties.

After the user successfully signs up (which will include setting the password), the AccountId and AccountName can be included in the token.

2) Create an external store that contains email -> accountid/accountname mapping. As the user signs up in Azure AD B2C, you can make a call to a Rest API to get the account id and account name and send in the token.