Power Apps Portal - Configure Azure AD Provider in Azure B2C

It is recommended that you no longer use Local Login authentication for Power Apps Portal but instead utilize Azure Active Directory B2C to provide this type of authentication. See Migrate identity providers to Azure AD B2C

Configuring the B2C providers is fairly straightforward utilizing the new preview interface Configure the Azure Active Directory B2C provider. Make sure you navigate to the preview version of the Maker portal for now to access this, https://make.preview.powerapps.com/.

For this article my goals were the following.

  • Set the existing Azure AD and Local Login configuration as deprecated authentication mechanisms within the portal to migrate the users to B2C.
  • Allow user to authenticate to B2C using Azure AD, Google or create local B2C account.

Original log in screen

Deprecate Old Providers

Once I had run through the instructions for configuring the Azure B2C authentication I then had to mark the Local Login and Azure AD authentication methods as deprecated. This ensures that when existing users log into the Portal using those methods, they will then be asked to migrate their account to B2C.

Account Migration

Deprecation of the old providers can be done through the Portal Management model app within the Site Settings.

Set Local Login Authentication as Deprecated

The site setting for deprecated the local authentication was already in my site settings so i set the value to true.
Deprecate Local Login

Name Value
Authentication/Registration/LocalLoginDeprecated true

Set Azure AD Authentication as Deprecated

In order to deprecate other providers you need to create the site settings for them and set the value to true. The format for these values is.
Authentication/[protocol]/[provider]/Deprecated

Deprecate Azure AD Authentication

Name Value
Authentication/OpenIdConnect/AzureAD/Deprecated true

Google Identity Provider

Setting up the Google identity provider was easy and the instructions provided worked without any issues. See Set up sign-up and sign-in with a Google account using Azure Active Directory B2C

Azure AD Provider

The instructions for Adding an Azure Active Directory provider to Azure Active Directory B2C but there were a few items missing to get it working correctly with Power Apps Portal.

If you don’t complete the additional steps you will end up with users in your B2C who do not have an email address assigned to them. Additionally, the persons email, first name and last name will not be provided to the portal which will result in the following error screen when new users attempt to register.
Email field is required

The first thing we need to do after creating the Azure AD provider app registration is to update the token configuration. This will ensure that email, first name, and last name are included correctly in the token.

  • Navigate to the directory in the Azure Portal where your Azure AD lives.
  • Create the app registration for the Azure AD Identity provider using the instructions found [here]((https://docs.microsoft.com/en-us/azure/active-directory-b2c/identity-provider-azure-ad-single-tenant?pivots=b2c-user-flow)
  • Under Manage click Token configuration
  • Click Add optional claim button
  • Select the Token type of ID
  • Click the check boxes next to eamil, family_name, given_name
  • Click the Add button
  • You will receive a message that the optional claims will require additional API permissions. Click the Turn on the Microsoft Graph email permission (required for claims to appear in token) checkbox and click the Add button.
    Token configuration

Next we must ensure that the API permissions that were added have admin consent

  • Under Manage click the API permissions
  • Click Grant admin consent for button
  • Click Yes when asked to grand admin consent
    Grant Admin Consent

I also found issues where the B2C configuration redirect URI utilize the tenant id instead of the domain name so I also added an extra Uri for that address.

Finally we need to update the Sign In/Sign Up user flow created during the B2C Portal setup.

  • Navigate to the director in the Azure Portal where you Azure B2C lives.
  • Within Azure services click on Azure AD B2C
  • Under the policies area click User flows
  • You should see 2 users flows. Select the one contaiing the text signupsignin
    Select User Flow
  • Click on Identity providers and ensure that you have selected the new Identity providers you have created. After selecting them click the Save button
    Choose Identity providers
  • Click on Application claims and select the Display Name, Email Addresses, Given Name, and Surname attributes then click the Save button.
    Select Application claims

Now when a user attempts to register using your AD provider the email, first name and last name will all be passed to the Portal and show up on the profile page after the user has logged in.

B2C Login Page
Profile Page After Login

Invitation Info

One thing I discovered through all this was that the Invitation system still works correctly after moving to B2C. I was able to create Invitations for contacts and redeem those invitation with the B2C provider in the exact same manner I did with the other providers.

Comments

  1. TIMOctober 26, 2023 at 8:21 PM

    Migrating to Azure Active Directory B2C for authentication in Power Apps Portal involves configuring B2C providers, deprecating old authentication methods, and setting up Google and Azure AD as identity providers. It also requires token configuration, admin consent, and adjusting the user flow to ensure accurate user data transfer. This transition maintains the invitation system's functionality. Getting bored to read it? Do you want to see Tv series see movies here.

    ReplyDelete

Post a Comment

Popular posts from this blog

Add User As Local Administrator On Domain Controller

I recently was settting up a new Microsoft SharePoint 2010 machine and had promoted the machine to a domain controller before creating my SharePoint admin accounts.  I needed to add several of my accounts to the local Administrators group.  Unfortunately after you promote a server to a domain controller you can no longer access the GUI for Local Users and Groups.  Instead I had to use the command line to add the users. Open a command promt using the "Run as administrator" function and then run the following command. net localgroup Administrators /add {domain}\{user} Note: do not include the {} brackets.
Read more

Calling Dataverse Web API in PowerShell using Client Credentials

Image
Connecting to Dataverse using PowerShell can be very helpful for data migrations and use within Azure DevOps. Connecting to an instance in a non-interactive way can be tricky though. This article will provide you the links you need for creation and App registration and adding the app user to your environment. You can then utilize the script provided to call Web API requests including ones you define using the new Custom API functionality now available. The script was written so that it is not dependent on any outside libraries such as the Microsoft.Xrm.Tooling connector. This is helpful in situation where involving an outside library will slow down your deployment time by having to be approved in a change control board. If utilizing an outside code library is not a concern you can create a connection to Dataverse utilizing the Microsoft.Xrm.Tooling connector Get-CrmConnection cmdlet. Create App Registration The first thing to do is create an App Registration within Azure AD for
Read more

Windows Server 2008R2 VMs Shut Down After 1 to 2 Hours

Image
When created a lab environment to test ADFS 2.0 I utilized the Windows 2008R2 VM baselines distributed by Microsoft.  After a few days I was told that I had to activate.  The VMs included a 180 day license for use but I didn't feel like adding another network adapter into Hyper-V to connect them to the internet.  I started having issues though where the servers would shut down every hour or so.  I though that maybe there was a memory issue and Hyper-V was shutting them down in order to free up RAM.  Turns out that if Server 2008R2 is not activated it automatically shuts down after a period of time.  After connecting the server to the internet and activating them the problem went away. Finally the madness of the unknown shut downs has ended :)
Read more