I am working with Azure AD B2C and I couldn't find the Dynamics CRM online option under API access(required permissions). Is there any way by which we can work with Dynamics CRM online in B2C.
Thanks in advance.
There is a built-in integration between Azure AD B2C and Dynamics 365 for Customer Engagement that enables external customer sign-ins using local accounts and/or any federated social identity providers.
See the Azure AD B2C provider settings for portals article for more information about configuring Azure AD B2C as an identity provider for the Dynamics 365 for Customer Engagement portal.
Related
Website webapp1.com has registered users with its own IdP implementation.
There are other websites such as webapp2.com, webapp3.com, webapp4.com (different domain).
A logged-in-user user1 of webapp1.com wants to do a SSO login to webapp2.com or webapp3.com or webapp4.com.
user1 has accounts in webapp2.com/webapp3.com/webapp4.com as well.
Is there a way to implement this using Azure AD or Azure AD B2C?
This is possible using PingIdentity.
https://www.pingidentity.com/en/resources/blog/posts/2021/sso-vs-federated-identity-management.html
Tried Azure AD and Azure AD B2C.
There is no documentation found how this could be done.
As long as the web apps connect to the same identity provider/s, the user will get SSO if they visit another app and pass through those same identity providers. With AAD this is the default and only behaviour. With AAD B2C this is the default behaviour, but can be restricted.
I understand that Azure AD B2C has an equivalent in AWS, which is AWS Cognito User Pool.
But it seems there is nothing equivalent to the Azure AD B2B. Is my understanding correct?
With Azure AD B2B, the partner uses their own identity management solution, so there is no external administrative overhead for your organization
Guest users sign-in to your apps and services with their own work, school, or social identities
There is no equivalent feature in AWS to Azure AD B2B
I want to build a public facing SaaS website. My users will either be:
enterprise customers and I will want them to be able to login with their corporate credentials.
non-enterprise customers. I will want the ability for them to register and use local credentials.
What would the solution look like? I'm thinking:
Use Azure AD and federate with the identity providers of my enterprise customers.
Use Azure B2C for my website, and configure #1 as my identity provider with the ability to create local accounts.
Is this the correct solution?
In your case, you can use Azure AD B2C for both the enterprise and non-enterprise customers
Enterprise customers and I will want them to be able to login with
their corporate credentials
You can use Azure AD B2C policy for the enterprise customers to use their corporate credentials for sign-in and sing-up
This policy uses a multi-tenant Azure AD application and the /common Azure AD endpoint to federate Azure AD B2C with any Microsoft 365 customer in the world
Non-enterprise customers. I will want the ability for them to register
and use local credentials
The users can sign-in and sign-up with their local accounts in the Azure AD B2C
You can refer this use-case provided by Microsoft for more info:
Azure Active Directory B2C | Overview with Example
We are using azure ad b2c for identity management and SSO for all our applications, So all our products/apps are registered on azure ad b2c directory. Users are also created on azure AD through MS Graph API. So all these users can avail the SSO facility. Now along with azure ad b2c we also want to use OneLogin. Is it possible with the existing azure ad b2c setup? I tried to google it but did not find any concrete answer. Can we add OneLogin as a identity provider like google, facebook in azure ad b2c?
Yes.
As per the docs, you can add any identity provider that supports OAuth 1.0, OAuth 2.0, OpenID Connect, or SAML protocols.
According to the Azure AD B2C FAQ:
Can I use Azure AD Connect to migrate consumer identities that are stored on my on-premises Active Directory to Azure AD B2C?
Azure AD Connect is not designed to work with Azure AD B2C...
Then why is it displayed here? And what can you do with Azure AD Connect and B2C then?
The displaying of that link implies there's a relationship between the two of them (to me at least).
The FAQ is correct in stating that Azure AD Connect is not supported with Azure AD B2C along with several other features of regular Azure AD.
These features show up in the Users and Groups blade because that blade was built primarily for regular Azure AD. There is work underway so that this blade understands it's running in the Azure AD B2C context and only shows applicable features.
Then why is it displayed here?
This is because that when you want to manager users and groups in Azure AD B2C, you must use Azure AD to manage it. Azure AD B2C cannot leave Azure AD. When you are using Azure AD B2C, you would have used Azure AD to authenticate Identity. As #Saca said, that blade was for Azure AD.
And what can you do with Azure ADConnect and B2C then?
That FAQ is right, but you can still use Azure Connect to sync on-premise users to Azure AD. You can also use the synced users accounts to login Azure AD B2C. But after syncing , the user name would changed to .onmicrosoft.com.
If you still want use your local account email address for the synced username, you can refer to this document and this official support article.