1
votes

Is there a way to create a link/URL that directs to the password reset policy, but skips the email verification part (directly to entering the new password), by implanting some kind of token to the URL?

e.g. https://mycompany.b2clogin.com/mycompany.onmicrosoft.com/oauth2/v2.0/authorize?p=B2C_1_password_reset&client_id=...&[email protected]&signature=....

(By verifying the signature field, the user flow will let me skip email verification, and use the email from the email field instead).

The reason I need it, is because as part of a migration process from an old system that doesn't use Azure B2C to a new system that does, we want to migrate users by creating an Azure AD B2C account for them via Graph API with an obscure password, and then send them an email that would direct them to the password reset policy.

Once they click on the link that was sent to their email, it would be redundant to ask them to insert and verify their email.

Is what I'm asking possible?

1

1 Answers

2
votes

You are able to send claims, such as the e-mail address for an end user, to a custom policy using a signed token.

An example of this can be found in the Azure AD B2C samples.