I found lot of threads regarding this but not sure if they are still valid at this point of time i.e. Jun 2019
This link which was updated on Jul 2017 says You must use Azure AD Graph API'to manage users in Azure AD B2C directory
But at the same time this link says As of February 2019, we started the process to deprecate some earlier versions of Azure Active Directory Graph API in favor of the Microsoft Graph API.
I found this link which has road map for AAD Graph and Micorsoft Graph. But still not clear weather we should use Microsoft Graph or Azure AD Graph for B2C tenant. I couldn't find any example how to fetch User attributes using Microsoft Graph
Question
Should I still keep on using 'Azure AD Graph'if I am dealing with B2C tenant?
You must use Azure AD Graph API to manage users in an Azure AD B2C tenant since Microsoft Graph doesn't support a few of the user properties (including the creationType property) that are used by Azure AD B2C.
Related
I've registered an application (Any Azure AD directory - Multitenant) in Microsoft Azure AD to be able to work with MS Graph API for creating the groups and teams programmatically. Now I'm able to call the MS Graph API and create the groups. The issue I'm having right now is I have a naming policy like this <Department> - <Group name> in Azure AD and as I call the MS Graph API with the application identity and as I don't have any department for my app, the department part is always empty. I would like to know if there is a way to set department or other attributes for the app in Azure AD?
Thank you in advance!
There is no option to add attribute for the app in azure ad.
We need to move users from an on-premise Active Directory on Windows Server (not Azure Active Directory) to Azure AD B2C. But, we're having difficulty in trying to figure out how to read the user data from the AD using Azure products.
We're thinking about using one of the following Azure products to read from on-premise AD, but it's surprisingly difficult to find if this is possible or not, much less how to do it:
Azure Data Factory
Azure Logic App
Microsoft Power Platform Dataverse (formerly Common Data Service)
Power BI Data Flows
Note: We can't use Azure AD Connect to migrate the users because that tool isn't designed to work with B2C. Reference Microsoft's Azure AD B2C: Frequently asked questions (FAQ).
The Microsoft article Migrate users to Azure AD B2C says that a script needs to be written that uses the Microsoft Graph API to create user accounts in Azure AD B2C. But the article doesn't give advice on how to access the source data, which in our case is AD.
There is no out-of-box Azure product/solution that connects to on-prem AD. Maybe there is a way which requires you create custom connector and custom API for querying AD users. See this post.
The quickest way is using PowerShell cmdlet Get-ADUser to export the AD users and then import them into Azure B2C via Microsoft Graph Create User.
I am trying to use a Azure AD Graph differential query or Microsoft Graph delta query to find changes in users within an Azure AD B2C tenant.
For example:
GET https://graph.microsoft.com/v1.0/users/delta
GET https://graph.windows.net/{tenantId}/users/?api-version=1.6&deltaLink=
Both result in:
Request_UnsupportedQuery
Change enumeration is not supported for requested tenant.
What is a supported tenant?
Differential query is an enterprise feature rather than a B2C one -- which is why it isn't available in an Azure AD B2C tenant.
Alternatively, you can access the audit logs in the Azure AD B2C tenant for the CRUD operations on users, using the Azure AD Reporting API.
It seems that they are not supported in Azure AD B2C, I can reproduce your issue, if I use it with a normal Azure AD tenant, it works fine.
Am I misinterpreting this -- see image?
I go to documentation for managing Azure AD B2C, it tells me to use Azure AD Graph API, not Microsoft Graph API.
Then I click the link to go to Azure AD Graph API, it tells me to use the Microsoft Graph API, not the Azure AD Graph API.
Two questions:
What do I use to manage users in Azure AD B2C? Microsoft Graph API or Azure AD Graph API?
What's the easiest and most painless way to interact with the Graph API I should be using -- based on your answer to question #1? Can I use a tool like Postman? If I'm not mistaken, these are RESTful APIs.
What do I use to manage users in Azure AD B2C? Microsoft Graph API or
Azure AD Graph API?
As the document noted, you must use Azure AD Graph API. Azure AD Graph API can manage users in a B2C tenant (set local accounts, sign in names), but Microsoft Graph API cannot do this for now. Although Microsoft Graph closing the gap with Azure AD Graph, but it still cannot have some capabilities as Azure AD Graph API.
What's the easiest and most painless way to interact with the Graph
API I should be using -- based on your answer to question #1? Can I
use a tool like Postman? If I'm not mistaken, these are RESTful APIs.
Absolutely, you can just use Azure AD Graph API for Azure AD B2C for now.
By the way, if you want to know which API is more fit for Azure AD. It's hard to say. Sometimes it depends on what scenario you're in. There is a sheet of Gaps between Microsoft Graph and Azure AD Graph:
Both two type APIs can be used in Postman.
Fore more details about Microsoft Graph or the Azure AD Graph , you can refer to this Blog.
According to the Azure AD B2C FAQ:
Can I use Azure AD Connect to migrate consumer identities that are stored on my on-premises Active Directory to Azure AD B2C?
Azure AD Connect is not designed to work with Azure AD B2C...
Then why is it displayed here? And what can you do with Azure AD Connect and B2C then?
The displaying of that link implies there's a relationship between the two of them (to me at least).
The FAQ is correct in stating that Azure AD Connect is not supported with Azure AD B2C along with several other features of regular Azure AD.
These features show up in the Users and Groups blade because that blade was built primarily for regular Azure AD. There is work underway so that this blade understands it's running in the Azure AD B2C context and only shows applicable features.
Then why is it displayed here?
This is because that when you want to manager users and groups in Azure AD B2C, you must use Azure AD to manage it. Azure AD B2C cannot leave Azure AD. When you are using Azure AD B2C, you would have used Azure AD to authenticate Identity. As #Saca said, that blade was for Azure AD.
And what can you do with Azure ADConnect and B2C then?
That FAQ is right, but you can still use Azure Connect to sync on-premise users to Azure AD. You can also use the synced users accounts to login Azure AD B2C. But after syncing , the user name would changed to .onmicrosoft.com.
If you still want use your local account email address for the synced username, you can refer to this document and this official support article.