Power Platform Community Forum Thread Details

Manage Azure AD B2C registration only from Dataverse and prevent external profile updates

Hello everyone,

My Power Portal must respect following authentication constraints:

Using Azure Active Directory B2C as Identity Provider;
External Users mustn't Signing-Up!
Only Back-Office must register contacts in Power Pages Portal and provide invitation to users by email notification;
Only Back-Office decide who to give access to and with which email address;
The invitation message provide indications: the identity email address that the external user must enter to SignIn;
The new external user can only Sign In using the e-mail provided by Back-Office and the password;
External users mustn't change Authentication email address;

In summary, only Back-Office administers contacts and manages SignIns from Dataverse Contact table.

(Optional) External User can change password (reset password);
(Optional) External User can receive a temporary password or invitation code;

My question is:

What is the best and fastest way (low customizations) to create this authentication with Azure AD B2C, please?

Many Thanks!

Categories:

Security

First you need to recognize that B2C and Power Pages are 2 separate things. B2C is the external identity provider (think of it like you do Facebook) and the Power Pages is just configured to trust it.

As they are 2 different things you need to approach it as such e.g. if you need to stop externals registering in B2C then you need to stop the registration in B2C and 'push' only those you want to sign-in into it.

Stopping external power pages registration is turning of Open Registration and enabling Invitations.

Reading a little bit between the lines what you will probably want is to (simplified):

Create Contact in Dataverse
Push that Contact to B2C using the Graph API (using custom code or power automate flow)
Create External Identity record in Dataverse (External Identity table is the link between the contact and external identity provider) populated with amongst other things the GUID from B2C user (that you get when you create the contact in B2C)
Update the Contact record, there are several fields that also need to be populated, Login Enabled, Security Stamp (populate with any guid), possibly one or 2 more
if not using Authenticated User inheritance, add a Web Role to the Contact record
Wait 15 mins (SLA of the portal's cache), then send email with login details.

(Note: it also possible to customize B2C to do things like check a user registering exists in another system etc)

Quick Links

Subscribe to this forum!