Azure Active Directory
Welcome to the Azure Active Directory suggestions and feedback site! We love hearing from you. If you have suggestions, please submit an idea or vote up an idea. We are monitoring the site actively.
Thank you for joining our community and helping improve Azure AD!
We
have a new log in experience integrated with Azure AD, and we strongly
recommend you log in with your Azure AD (Office 365) account. If your
UserVoice account is the same email address as your Azure AD account, your
previous activities will be automatically mapped to your Azure AD account. You can read more here for details: https://techcommunity.microsoft.com/t5/Azure-Active-Directory-Identity/Putting-customers-first-for-f...
-
Get user membership groups in the claims with AD B2C
As it's possible in the standard AD by changing the API application manifest option "groupMembershipClaims" to "SecurityGroup", is it possible to return user membership group in the claims with AD B2C?
Now, we can have only the default and custom attributes by adding a signin policy, but it's impossible to get user membership groups.
929 votesWe definitely recognize the popularity of this feature, and we discuss it constantly during the planning phases. However there are certain technical limitations in the system that add a large amount of development cost. Because of the cost and the fact that there is a workaround available, other features get prioritized over this one.
That being said, please keep voting for it. The popularity of the feature does help bring it up and makes us reconsider every time.
Apologies for the delay.
/Parakh
Old message:
We’re doing some research both on the specifics of this ask as well as what it would take to support this.
Is the ask here to do the same thing that regular Azure AD does (see: https://blogs.technet.microsoft.com/enterprisemobility/2014/12/18/azure-active-directory-now-with-group-claims-and-application-roles/) or is are there different requirements around this for Azure AD B2C? -
Fully customizable verification emails
Currently, Azure AD B2C sends verification codes via emails to end users during sign-up and password reset flows. These emails have limited customization. Add support for full customization of the email body & content.
755 votesWe are prioritizing this customer ask on team and are looking at options to enable this broadly for customers.
-
Customer-owned domains
Run Azure AD B2C's sign-up & sign-in pages under a custom domain, for e.g., login.contoso.com, instead of login.microsoftonline.com.
499 votesDue to various technical limitations, the first iteration of the customer-owned domains functionality will not be available for a few more months. We will provide an update as soon as we can get a more specific ETA.
If you are looking to use custom domains to use javascript, we are now looking to enable that experience by providing a new (non-customizable) domain. Please look for updates here: https://feedback.azure.com/forums/169401-azure-active-directory/suggestions/15493536-add-support-for-javascript-inside-the-custom-ui-br
/Parakh
-
B2C Fully Customizable Sign-In Page
Create a Sign In Policy by which we can provide our own template for the sign in page. It could work the same way as the Sign Up policy does.
347 votesHi all,
We’ve put out a new version of the sign in policy called sign in v2. This is available through the new portal experience and we have rebranded policies as user flows. Please give this a try and give us feedback through this link: https://microsoft.qualtrics.com/jfe/form/SV_0Gu45RkBy2YR1kh
/Sam
-
Add support for Resource Owner Password Credentials flow in Azure AD B2C and headless authentication in Microsoft Authentication Library
Add support for Resource Owner Password Credentials flow in Azure AD B2C and headless authentication in Microsoft Authentication Library, just like Azure AD and Active Directory Authentication Library has.
The Azure AD B2C page has been saying 'Get tokens using a username & password with the OAuth 2.0 Resource Owner Password Credentials Flow (coming soon)' since September 2015.
https://azure.microsoft.com/en-us/documentation/articles/active-directory-b2c-reference-protocols/301 votesJust to provide an update, we are close to launching a private preview. We are in the final testing stages for this feature. We will have another update in the next few weeks with instructions on how to join the private preview.
-
AADB2C: Send email invitation for new user to sign up
I would like the ability to trigger an email invitation be sent to new users for our web application that I want to authenticate with AADB2C. In our multi-tenant design, each tenant will be responsible for adding their own users to their tenant. I would like the admin of the tenant to be able to send an email invitation to the new user and then that user can complete the sign-up process.
298 votesThank you for the feedback. We are strongly considering this for the future. Today we are focusing on customer facing apps with open self-service signup. /Jose Rojas
-
286 votes
Hi all,
This is currently available for custom policies, you can find the instructions here: https://docs.microsoft.com/azure/active-directory-b2c/javascript-samples
We will be bringing this to built in as well in the coming weeks.
/Sam
-
Add an Azure AD Identity Provider
AADB2C is great, but why not adding an Azure AD provider? We're developing an application where we can have customers with social identities as well as Azure AD identities, it would be great in the AADB2C login page to have an option like "Organization Account". In this way we can code against one single API and not be forced to use two different entry points.
275 votesWe have released the public preview for this feature! Learn more about how to use it here: https://docs.microsoft.com/azure/active-directory-b2c/active-directory-b2c-setup-oidc-azure-active-directory
/Sam
-
SAML protocol support
Azure AD B2C currently supports OpenID Connect and OAuth 2.0. Add SAML protocol support as well.
263 votesSeems like this feature request was not updated when the feature was announced. Talking to a SAML2.0 identity provider is possible if you use custom policies: https://docs.microsoft.com/en-us/azure/active-directory-b2c/active-directory-b2c-overview-custom
/Parakh
-
Add Japan region to data residency location of Azure AD B2C
Lots of Japanese customers would like to use Azure AD B2C. But they can not decide to adopt B2C because we do not have Japan region as data residency location.
214 votesWe are hoping to support more datacenters in the future, especially in the Asia/Pacific region, but it is not currently planned for the short term.
/Parakh
-
AADB2C: Support OAuth 2.0 client credential flow
As mentioned in the B2C limitations:
https://azure.microsoft.com/en-us/documentation/articles/active-directory-b2c-limitations/
Our daemons / server-side applications need this feature as part of our security implementation in order to grant access to our web apis.
209 votesCurrently, you can use “App Registration” blade in the Azure Portal (outside of the Azure AD B2C blades) to register an apps that define application permission and the register apps that use client credentials to request these. The caveat is that this is done using the same mechanism that you’d use in regular Azure AD.
Ideally we’d have a first class experience for this in the Azure AD B2C blades or at least have an Azure doc that walks you through the experience I just summarized, so I’m leaving this feature ask open.
It would be great if you guys can add comments with your feedback. What scenarios areyou trying to achieve? Does the approach above help you achieve what you want to achieve? Does the experience to do so work for you guys and if not, what would you like to see?
-
AADB2C: Force password reset
Add the ability to force user's to reset password at next login. It would be ideal if this was available for both individual users as well as in bulk. This is necessary for situations such as credential leaks, etc.
192 votesWe have started the planning for this feature and hope to have a preview by the end of the calendar year. In the meantime, could you respond to aadb2cpreview@microsoft.com with the answers to the following questions:
- In which scenarios do you plan to force the user to change his/her password?
- What kind of information (if any) would you like to get back if the user goes through the reset flow?
- Do you currently or plan to track which users have reset their password? -
Azure AD B2C, How to Avoid / Validate, duplicate Sign up with Social Identity Providers
Hi, Assume, I sign up with Google 'siva@gmail.com', it creates a user in the tenant. I sign up with Facebook 'siva@gmail.com', it creates another user in the tenant. Also I went and Sign up using email account, for 'siva@gmail.com', now am finding 3 users with same email id. I see this is a duplicate accounts are getting created. Is there any way this can be validated & inform user in Azure AD B2C ?
180 votesThank you. We will examine the experience of duplicate sign ups across Identity providers. Would performing this check by using the email address be sufficient?
BTW, Linking multiple provider accounts to one user is in our roadmap and we’ve already achieved it in preview…
We look forward to your feedback
/Jose Rojas
-
Add support for the Microsoft Authenticator app in B2C
Enable the Microsoft Authenticator app to be used for 2FA in Azure B2C.
166 votesWe are looking to add additional MFA options for Azure AD B2C in the next few months. As part of the investigation, we want to learn more about your requirements. Email your feedback to aadb2cpreview@microsoft.com.
When you say “support for Microsoft Authenticator”, which feature are you referring to?
1. The ability to see the codes in the authenticator app
2. The ability to receive push notifications for MFAIf both, which do you prefer more?
Again, please email your feedback to aadb2cpreview@microsoft.com. Feel free to include more details about your scenarios/requirements!
-
Azure AD B2C Data Residency in Australia
Although Azure AD B2C is available for use in Australia, there is not option to create a directiry for which the user data resides in Australia. We would like to be able to ensure that our Azure AD B2C user data remains in Australia.
162 votesUnfortunately, we have no plans for data residency in Australia. If this is key to your needs please continue voting and we will use this to help us prioritize this in the future.
-
B2C Support for client credential flow.
To enable APIs to use authentication from another application with separate security credentials (clientId+secret). Needed for APIs to make graph calls.
(This is not the same as on-behalf-of flow, which represents the ability to exchange an access token intended for one audience for an access token intended for a different audience)
147 votesThis is not planned for the next 6 months, but is on the roadmap.
/Parakh
-
Programmatically register B2C applications
I want to be able to call a Graph API to register new B2C applications
130 votesThis feature is temporarily put on the backlog. Work will resume in the 4th quarter of 2018, so a public preview should be available by the end of 2018.
/Parakh
-
Phone number sign-up
Local accounts currently allows email addresses and usernames as sign-in identifiers. Add phone numbers as well.
121 votesWe are interested in enabling this scenario and are looking for more data.
- Would you want to be able to use this in conjunction with email or would you only be interested in one way to sign up accounts at a time?
- Would you like to be able to create the account without needing an email at all?/Sam
-
AADB2C: How-to on multi-tenant applications based on B2C
As service provider using Azure as the underlying platform, I want to create an application that allows companies to create and manage their tenants and users within my service in order to provide a public service area as well as a privately owned area for the company.
I've read about B2C supporting multi-tenant, but I couldn't find hints within the documentation...
108 votesWe are currently prioritizing Azure AD as and identity provider into B2C. We will review this request after that work is done. Keep the requests coming! /Jose Rojas
-
Programmatically manage B2C policies
I want to be able to call the Graph API or use PowerShell to manage Azure AD B2C policies.
106 votesWe currently have a private preview for custom policies, you can see the documentation here: https://github.com/Azure-Samples/active-directory-b2c-console-custom-policy-api
You can request private preview access by sending an email to aadb2cpreview@microsoft.com with your directory name.
We will be following up with other scenarios for programmatic APIs.
- Don't see your idea?