Azure AD B2C Creating a Social Account Using Graph API Create User

Question

I am attempting to create user social accounts for Microsoft logins on my B2C tenant without using the sign up userflow. When the sign up userflow is ran and you register a Microsoft Account a user is created in the tenant with a source of "Microsoft Account".

I have been experimenting with the Microsoft Graph API using the create user post request where in i can create a working local account fine but am having issues creating a Microsoft user that works with the B2C Login using the examples in the link below. I don't think I have a valid issuerAssignedId for the Microsoft accounts I am creating and I am not actually trying to migrate existing accounts. The user record is created in B2C when the post request is ran but when i try to log in using the microsoft account it is responding back with AADB2C99002: User does not exist.

https://docs.microsoft.com/en-us/graph/api/user-post-users?view=graph-rest-1.0&tabs=http#example

Not exact values but example of payload i am using:

{
  "displayName": "Test Name",
  "identities": [
    {
      "signInType": "emailAddress",
      "issuer": "mytenant.onmicrosoft.com",
      "issuerAssignedId": "[email protected]"
    },
    {
      "signInType": "federated",
      "issuer": "live.com",
      "issuerAssignedId": "[email protected]"
    }
  ],
  "passwordProfile" : {
    "password": "password-value",
    "forceChangePasswordNextSignIn": false
  },
  "passwordPolicies": "DisablePasswordExpiration"
}

Is there a way I can achieve this? Thanks.

Allen Wu Allen Wu · Accepted Answer · 2020-11-05T02:18:57

I don't think I have a valid issuerAssignedId for the Microsoft accounts I am creating and I am not actually trying to migrate existing accounts.

You cannot use Microsoft Graph API to create an MSA which doesn't exist.

Although the user record is created in B2C when the post request is ran, it is only a record as you mentioned.

The real identity authentication process is done by MSA rather than B2C.

So AADB2C99002: User does not exist is the expected behavior in this case.

You can set a non-existing MSA while calling this Microsoft graph endpoint, but it will not create an MSA in the MSA IDP side. So you cannot log in with it.

The best practice is to create the MSA in advance and use it for this Graph call.

Azure AD B2C Creating a Social Account Using Graph API Create User

1 Answers