} ], "creationType": "LocalAccount", // Always set to 'LocalAccount' "displayName": "Joe Doe", "mailNickname": "joe", "passwordProfile": { "password": "Pass@word1", "forceChangePasswordNextLogin": false }, "passwordPolicies": "DisablePasswordExpiration" } Note A switch allows to disable password complexity checks during local account creation. This allows you to migrate local accounts from an on-premises database (with password complexity rules different from that of Azure AD B2C’s) into your B2C tenant. Note For more information, see article . Programmatically getting access to consumer activity reports Finally, for this introduction of Azure AD B2C, you can leverage the REST-based Azure AD reporting API to get access to rich consumer activity reports. Note For more information, see article of the . You can easily pipe the data from these reports into business intelligence and analytics tools, such as , for detailed analyses. As of this writing, the following four activity reports are currently available: tenantUserCount. Total number of consumers in your Azure AD B2C tenant (per day for the last 30 days). You can also get a breakdown by the number of local accounts (password-based accounts) and social accounts (Facebook, Google, etc.). b2cAuthenticationCount. Total number of successful authentications (sign-up, sign-in, etc.) within a specified period. b2cAuthenticationCountSummary: Daily count on successful authentications for the last 30 days. b2cMfaRequestCountSummary. count of multi-factor authentications (MFA) for the last 30 days. Note For more information, see article .
Configuring the local account provider A account provider is created by default on your newly created B2C tenant. To select how to create local accounts, proceed with the following steps: Switch back to the B2C features or navigate to the related URL (see above). On the B2C features blade, click Identity providers. An Identity providers blade opens. In Local accounts, choose how users will create their accounts local to this B2C tenant: Email (default). Users will be prompted for an email address which will be verified at and become their user identifier. Username. Users may create their own unique user identifier. An email address will be collected from the user and verified at sign-up. Configuring social identity providers You now have to proceed with the configuration of the social identity providers you want to use on your B2C tenant. Before you complete the configuration, you need to create first application registrations on the related social identity provider developer portals and supply them with the right parameters to work properly with the Azure AD B2C service. This section you how to configure Facebook and Google+ as social identity providers on your B2C tenant. Note For more information, see articles , and . Note For instructions on configuring Amazon, LinkedIn an Microsoft Accounts, see articles , , . Creating a Facebook application To use Facebook as a social identity provider in Azure AD B2C, you will first need to create a Facebook application and supply it with the right parameters. You need a Facebook account to perform the following steps. If you don’t have one, create one at . To create a Facebook application, proceed with the following Open a separate browser window / tab and navigate to the Facebook Developers website at . Click Log In in the toolbar. Sign-in with your Facebook account credentials. If you have not already registered, click My Apps. Register as a Developer. up
Switch back to the (classic) Azure portal or navigate to it at . Sign in as the Subscription Administrator if needed. This is the same work or school account or the same Microsoft Account that you used to create your B2C tenant above. Navigate to the B2C tenant on the ACTIVE DIRECTORY extension by clicking in our configuration Contoso 369 Corporation. Click USERS. End users that signed up with a social identity are listed as cpim_<user#>@<YourDirectory>.onmicrosoft.com, where <YourDirectory> is the B2C tenant you created, and <user#> an allocated user number, for example in our configuration: cpim_964916140232284@contoso369b2c.onmicrosoft.com. Likewise, end users that signed up locally with a verified address mail are listed as <VerifiedEmailAddress>1#EXT#@<YourDirectory>.onmicrosoft.com, <VerifiedEmailAddress> is the verified email address where @ is replaced by an underscore. Adding Multi-Factor Authentication As previously depicted, Azure AD B2C integrates directly with Azure MFA to allow you to smoothly add an additional factor of authentication to sign-up and sign-in experiences in your consumer-facing applications Note For more information, see article . Let’s modify both the previously configured sign-up and sign-in policies, and try the reconfigured policies. Modifying the sign-up policy to enable authentication To enable a multi-factor authentication in the sign-up policy, proceed with the following steps: Switch back to the B2C features blade or navigate to the related URL: Sign-up policies. Click the previously configured B2C_1_B2CSignUp sign-up policy to open it. Click Edit at the top of the blade, and then click Multifactor authentication. Toggle State to ON. Click OK. Click Save at the top of the blade. A consumer account gets created in your B2C tenant before the multifactor authentication step occurs. During the step, the consumer is asked to provide their phone number and verify it. If verification is