Custom Azure B2C Password Reset Flow via Username

3
votes

I setup a password reset flow using Azure B2C and local Azure accounts that uses the user's email address and verification code. However, my client would like to have a password reset email sent to the user based on the user name, not email address. The user email would be looked-up behind the scenes and an email sent that would include a link to the password reset page as shown in the flow below.

After reading a gazillion articles on custom Azure B2C policies, I'm struggling to convince myself if it is possible to do what the client is asking for using Azure B2C.

In the sample password reset flow shown below, some of the areas I'm struggling with include:

  • Is it possible to create custom pages in the password reset flow such as the page in Step 4 that displays the user's masked email address, or the information page in Step 7?
  • Is there built-in functionality to look-up a user's email address and Active Directory Object ID based on their user name or would I have to call out to a custom Azure Function and use the Graph API to do this?
  • Is it possible to create and send a custom email that includes a hyperlink to the password reset page that includes the user's Active Directory Object ID as a query string parameter so the password reset page knows which user's password is being reset?

At the moment, it seems like it would be easier to create a completely custom ASP.NET MVC app to handle the requirements than it would be to use Azure B2C custom policies, but that isn't really a path I want to go down.

enter image description here

2
azureazure-active-directoryazure-ad-b2c
If my answer helpful You can mark it by clicking on checkbox beside your question. So it would be helpful for other . Thanks – Md Farid Uddin Kiron

2 Answers

0
votes
  • Is it possible to create custom pages in the password reset flow?

Yes you can create your own custom password reset user flow using azure active directory B2C

In your case if you want to figure out your custom page you could refer here

  • Is there built-in functionality to look-up a user's email address and Active Directory Object ID based on their user name or would I have to call out to a custom Azure Function and use the Graph API to do this?

Using Microsoft Graph REST API you could fetch your user information. In your case you could use

  • Is it possible to create and send a custom email that includes a hyperlink to the password reset page that includes the user's Active Directory Object ID as a query string parameter so the password reset page knows which user's password is being reset?

You can use the company branding feature to customize the content of verification emails for resetting password.

Note : For better clarity you could check the Azure AD B2C: Frequently asked questions (FAQ) before final work around Which definitely guide you to define ultimate go ahead.

Update

enter image description here

As per Microsoft document right now you cannot create according to your sample exactly. See the screen shot there is and important remarks.

Thank you.

0
votes

This GitHub project covers the case you describe. Still needs a lot of understanding about custom flows to get it working. https://github.com/yoelhor/aadb2c-verification-link