Azure AD B2C custom policy solutions and samples.
[!NOTE]
Azure AD B2C is currently on path to deprecation (2030) and this repository is no longer being maintained. Entra External Id supersedes AAD B2C.
In this repo, you will find samples for several enhanced Azure AD B2C Custom CIAM User Journeys.
See our Custom Policy overview.
See our Azure AD B2C Wiki articles to help walkthrough the custom policy components.
See our Custom Policy Schema reference.
You will require to create an Azure AD B2C directory.
You can automate the prerequisites (where applicable) by using our using automated tool called Deploy AAD B2C Custom Policies if you already have an Azure AD B2C tenant.
Samples are available for the following categories
| Sample name | Description | Quick deploy | Demo |
|---|---|---|---|
| Password reset via email or phone verification | Verify a user via Email or SMS on a single screen. | Go | Live demo |
| Force password reset | As an administrator, you can reset a user's password if the user forgets their password or you would like to force them to reset the password. In this policy sample, you'll learn how to force a password reset in these scenarios. | Go | Live demo |
| Force password reset first logon | Force a user to reset their password on the first logon. | Go | |
| Force password after 90 days | Force a user to reset their password after 90 days from the last time user set their password. | Go | |
| Password reset only | Prevents issuing an access token to the user after resetting their password. | Go | Live demo |
| Sign-up and sign-in with embedded password reset | Embed the password reset flow a part of the sign-up or sign-in policy without the AADB2C90118 error message. | Go | Live demo |
| Password Reset with Phone Number | Reset a users password using Phone Number (SMS or Phone Call). | ||
| Password reset without the ability to use the last password | Force password reset/change flow where the user cannot use their currently set password. | Go | Live demo |
| Banned password list | Banned password list prevention during Sign up and password reset/change flow. This sample does not use an API. | Go | Live demo |
| Password Reset sends verification code only if the email is registered | Display control to send verification code to users only if the email is registered against a user in the directory. | Go | Live demo |
| Password history | Prevent the previous Nth password to be set during password reset/change. Requires using external storage and web services. | NA |
| Sample name | Description | Quick deploy | Demo |
|---|---|---|---|
| Revoke Azure AD B2C session cookies | Demonstrates how to revoke the the single sign on cookies after a refresh token has been revoked. | Go | |
| Google Captcha on Sign In | An example set of policies which integrate Google Captcha into the sign in journey. | NA | |
| Disable and lockout an account after a period of inactivity | For scenarios where you need to prevent users logging into the application after a set number of days. The account will also be disabled at the time of the users login attempt in the case the user logs in after the time period. | Go | |
| Restrict B2C Policy to specific App Registration | Only permits certain application registrations to call certain B2C policy Id's. | Go | Live demo |
| Impersonation Flow | For scenarios where you require one user to impersonate another user. This is common for support desk or delegated administration of a user in an application or service. It is recommended to always issue the token of the original authenticated user and append additional information about the targeted impersonated user as part of the auth flow | Go | |
| Social identity provider force email verification | When a user signs in with a social account, in some scenarios, the identity provider doesn't share the email address. This sample demonstrates how to force the user to provide and validate an email address. | NA | Live demo |
| Sign-in with social identity provider and force email uniqueness | Demonstrates how to force a social account user to provide and validate their email address, and also checks that there is no other account with the same email address. | NA | |
| Preventing logon for Social or External IdP Accounts when Disabled in AAD B2C | For scenarios where you would like to prevent logons via Social or External IdPs when the account has been disabled in Azure AD B2C. | NA | |
| User groups | Returns the user security groups. | NA | |
| Sign-in with Conditional access | Azure Active Directory (Azure AD) Conditional Access is the tool used by Azure AD B2C to bring signals together, make decisions, and enforce organizational policies. Automating risk assessment with policy conditions means risky sign-ins are at once identified and remediated or blocked. | Go | Live demo |
| Allow/Deny based on Hostname | This sample provides an example of how to block access to particular B2C policy based on the [Hostname] of the request, e.g. allow requests made to the policy using login.contoso.com but block foo.b2clogin.com. Useful when using custom domain(s) with Azure AD B2C. | Go | |
| Call center validation | A call center uses Azure AD B2C to validate a customer phoning in. To do this, the call center takes three characters from the password and asks the customer calling in to provide the three characters plus some other known facts as part of the authentication process. | NA | |
| Measure the time of the user journey | Shows how to measure the time takes the user complete the sign-up or sign-in flow. | NA |
| Sample name | Description | Quick deploy | Demo |
|---|---|---|---|
| Dynamic sign up or sign in | allows dynamically detecting whether a user can sign in or sign up. The user enters their email and is asked to verify their password if the account exists. If the account does not exist, the user goes through a sign up flow. | Go | Live demo |
| Split Sign-up into separate steps for email verification and account creation | When you don't want to use the default Sign-up page which shows both email verification and user registration controls on the same page at once. This sample splits the default sign-up behavior into two separate steps. First step performs Email Verification only, avoiding all other default fields related to users registration. Second step (if email verification was successful) takes the users to a new screen where they can actually create their accounts. This uses Azure AD to send out emails, no separate email provider integrations needed. | Go | Live demo |
| Sign In and Sign Up with Username or Email | This sample combines the UX of both the Email and Username based journeys. | Go | Live demo |
| Local account change sign-in name email address | During sign-in with a local account, a user may want to change the sign-in name (email address). This sample policy demonstrates how to allow a user to provide and validate a new email address, and store the new email address to the Azure Active Directory user account. After the user changes their email address, subsequent logins require the use of the new email address. | Go | Live demo |
| Username discovery | This example shows how to discover a userna |
No open issues yet, or sync has not completed.