Azure B2C Error: Application faulted after creating new app in MSAL portal

0
votes

I am trying to figure out which admin account I should use while creating the Azure B2C application with a v2 MSAL endpoint. I've observed that both the process and outcome are different when I use:

  • The default Office365 + AAD admin account
  • A long lived LiveID account
  • An administrator created within the B2C directory itself

Each of these accounts were used to create an application in the MSAL (converged?) portal.

Azure AD Account

I have an Office 365/AAD admin user with an @[tenant].onmicrosoft.com address.

enter image description here

When creating the application, I see an alert saying that this application will be created in my AD tenant (presumably the Office 365 Admin account and not the connected b2c)

This application will be registered in the Azure Active Directory instance used to manage your *.onmicrosoft.com account

[Screenshot)

enter image description here

I wanted to have a school or work user authenticate to the B2C instance., however the simulator gave me an error.

Since the error was based on the user not having access to the directory, I decided to try recreating the app using a new admin account, created exclusively in that b2c tenant directory:

enter image description here

I created a new @[tenant].onmicrosoft.com b2c admin user, and tried recreating a new appID/ClientID. The basis of my thinking is that when I used the Global Admin from my Azure+Office365 account caused confusion in the B2C tenant.

When I inspect the application in the Azure portal (opposed to the MSAL portal), I get this error

enter image description here

Which leaves me asking:

  • Which portal should I use when creating a MSAL v2 application?
  • Who should I be logged in as (Office365 AAD Admin, Dirsync-enabled AAD Admin, B2C Admin, LiveID)
  • Who shouldn't I be logged in as?

My intention is to authenticate School and Work users using the MSAL library.. in addition to Facebook and Google, depending on the signin policy.

LiveID on MSALv2 app portal

To complete my testing of combinations, this is the MSALv2 portal I get when using a LiveID user. (previous screenshots are from an AAD or B2C user). Note that the section headers are different, possibly implying a functional difference as well. I want to confirm that Converged applications equals My Applications in the earlier screenshot.

enter image description here

1
azureazure-active-directoryazure-ad-b2cmicrosoft-account

1 Answers

1
votes

As described by Azure Active Directory B2C: Register your application, you should register an Azure AD B2C application using:

  1. The Azure portal
  2. A Global Administrator for the Azure AD B2C tenant

Any application registrations that are created using the Azure portal must be managed using the Azure portal.

If you modify the application registration using the Application Registration portal or PowerShell, it becomes a "faulted" app.

Although the Global Administrator can be a guest of the B2C tenant, it is recommended the Global Administrator is a member of the B2C tenant.