Azure B2C secure API MFA

Question

I have an API (not in Azure) where some resources only need SFA and some need MFA. Using an access token from Azure B2C, is it possible to validate this or do I then need to get the ID Token? Also what is the correct response if user is SFA but endpoint needs MFA?

My initial thought was making sfa and mfa a scope and then asking for an access token for the scope I need but the access token is granted based on application not on user isn't it? It would have been good to be able to ask for an access token for a particular scope, that scope linked to an authentication policy and then only returned if user is authenticated to that level (taking them through the process if they are not)

thanks

Answer 1

You could create two policies, one with MFA and one without. You can enable SSO between those policies. The API that requires MFA will use the policy with MFA.

If the user sign-ins using the SFA policy, and later attempts to access the MFA API, the user will be blocked (because the authentication will not have happened with MFA policy).

The APIs should use the iss and tfp claims to validate that the correct policy was used.