You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/active-directory-b2c/aad-sspr-technical-profile.md
+5-7Lines changed: 5 additions & 7 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -23,7 +23,7 @@ Azure Active Directory B2C (Azure AD B2C) provides support for verifying an emai
23
23
This technical profile:
24
24
25
25
- Doesn't provide an interface to interact with the user. Instead, the user interface is called from a [self-asserted](self-asserted-technical-profile.md) technical profile, or a [display control](display-controls.md) as a [validation technical profile](validation-technical-profile.md).
26
-
- Uses the Azure AD SSPR service to generate and send a code to an email address, and then verifies the code.
26
+
- Uses the Azure AD SSPR service to generate and send a code to an email address, and then verifies the code.
27
27
- Validates an email address via a verification code.
@@ -57,7 +57,6 @@ The **InputClaims** element contains a list of claims to send to Azure AD SSPR.
57
57
| --------- | -------- | ----------- |
58
58
| emailAddress | Yes | The identifier for the user who owns the email address. The `PartnerClaimType` property of the input claim must be set to `emailAddress`. |
59
59
60
-
61
60
The **InputClaimsTransformations** element may contain a collection of **InputClaimsTransformation** elements that are used to modify the input claims or generate new ones before sending to the Azure AD SSPR service.
62
61
63
62
### Output claims
@@ -81,12 +80,11 @@ The following metadata can be used to configure the error messages displayed upo
81
80
| UserMessageIfInternalError | No | User error message if the server has encountered an internal error. |
82
81
| UserMessageIfThrottled| No | User error message if a request has been throttled.|
83
82
84
-
85
83
### Example: send an email
86
84
87
85
The following example shows an Azure AD SSPR technical profile that is used to send a code via email.
* Users can sign in with an Azure AD B2C Local Account
28
28
* Sign-up or sign-in with a social account
@@ -74,7 +74,7 @@ To add sign-in policy:
74
74
75
75
## Remove the sign-up link
76
76
77
-
The **SelfAsserted-LocalAccountSignin-Email** technical profile is a [self-asserted](self-asserted-technical-profile.md), which is invoked during the sign-up or sign-in flow. To remove the sign-up link, set the `setting.showSignupLink` metadata to `false`. Override the SelfAsserted-LocalAccountSignin-Email technical profiles in the extension file.
77
+
The **SelfAsserted-LocalAccountSignin-Email** technical profile is a [self-asserted](self-asserted-technical-profile.md), which is invoked during the sign-up or sign-in flow. To remove the sign-up link, set the `setting.showSignupLink` metadata to `false`. Override the SelfAsserted-LocalAccountSignin-Email technical profiles in the extension file.
78
78
79
79
1. Open the extensions file of your policy. For example, _`SocialAndLocalAccounts/`**`TrustFrameworkExtensions.xml`**_.
80
80
1. Find the `ClaimsProviders` element. If the element doesn't exist, add it.
@@ -99,7 +99,7 @@ The **SelfAsserted-LocalAccountSignin-Email** technical profile is a [self-asser
99
99
100
100
1. Within `<BuildingBlocks>` element, add the following [ContentDefinition](contentdefinitions.md) to reference the version 1.2.0, or newer data URI:
@@ -60,7 +60,6 @@ The **InputClaims** element contains a list of claims to send to Conditional Acc
60
60
| IsFederated | Yes |boolean | Indicates whether or not a user signed in with a federated account. The value must be `false`. |
61
61
| IsMfaRegistered | Yes |boolean | Indicates whether the user already enrolled a phone number for multi-factor authentication. |
62
62
63
-
64
63
The **InputClaimsTransformations** element may contain a collection of **InputClaimsTransformation** elements that are used to modify the input claims or generate new ones before sending them to the Conditional Access service.
65
64
66
65
### Output claims
@@ -78,7 +77,7 @@ The **OutputClaimsTransformations** element may contain a collection of **Output
78
77
79
78
The following example shows a Conditional Access technical profile that is used to evaluate the sign-in threat.
| ChallengesSatisfied | Yes | stringCollection| The list of satisfied challenges to remediate the identified threat as return from the evaluation mode, challenges claim.|
121
120
122
-
123
121
The **InputClaimsTransformations** element may contain a collection of **InputClaimsTransformation** elements that are used to modify the input claims or generate new ones before calling the Conditional Access service.
Copy file name to clipboardExpand all lines: articles/active-directory-b2c/conditional-access-user-flow.md
+3-3Lines changed: 3 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -22,7 +22,7 @@ Automating risk assessment with policy conditions means risky sign-ins are ident
22
22
Azure AD B2C evaluates each sign-in event and ensures that all policy requirements are met before granting the user access. During this **Evaluation** phase, the Conditional Access service evaluates the signals collected by Identity Protection risk detections during sign-in events. The outcome of this evaluation process is a set of claims that indicates whether the sign-in should be granted or blocked. The Azure AD B2C policy uses these claims to act within the user flow. An example is blocking access or challenging the user with a specific remediation like multi-factor authentication (MFA). “Block access” overrides all other settings.
23
23
::: zone pivot="b2c-custom-policy"
24
24
The following example shows a Conditional Access technical profile that is used to evaluate the sign-in threat.
@@ -41,7 +41,7 @@ The remediation may also happen through other channels. For example, when the ac
41
41
> To remediate the risk successfully within the journey, make sure the *Remediation* technical profile is called after the *Evaluation* technical profile is executed. If *Evaluation* is invoked without *Remediation*, the risk state will be *At risk*.
42
42
When the *Evaluation* technical profile recommendation returns `Block`, the call to the *Evaluation* technical profile is not required. The risk state is set to *At risk*.
43
43
The following example shows a Conditional Access technical profile used to remediate the identified threat:
@@ -350,7 +350,7 @@ To enable Conditional Access for a user flow, make sure the version supports Con
350
350
### Configure claim other than phone number to be used for MFA
351
351
In the Conditional Access policy above, the `DoesClaimExist` claim transformation method checks if a claim contains a value, for example if the `strongAuthenticationPhoneNumber` claim contains a phone number.
352
352
The claims transformation isn't limited to the `strongAuthenticationPhoneNumber` claim. Depending on the scenario, you can use any other claim. In the following XML snippet, the `strongAuthenticationEmailAddress` claim is checked instead. The claim you choose must have a valid value, otherwise the `IsMfaRegistered` claim will be set to `False`. When set to `False`, the Conditional Access policy evaluation returns a `Block` grant type, preventing the user from completing user flow.
Copy file name to clipboardExpand all lines: articles/active-directory-b2c/contentdefinitions.md
+7-7Lines changed: 7 additions & 7 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -75,7 +75,7 @@ The **ContentDefinition** element contains the following elements:
75
75
76
76
The **LoadUri** element is used to specify the URL of the HTML5 page for the content definition. The Azure AD B2C [custom policy starter-packs](https://github.com/Azure-Samples/active-directory-b2c-custom-policy-starterpack) come with content definitions that use Azure AD B2C HTML pages. The **LoadUri** starts with `~`, which is a relative path to your Azure AD B2C tenant.
@@ -84,12 +84,12 @@ The **LoadUri** element is used to specify the URL of the HTML5 page for the con
84
84
85
85
You can [customize the user interface with HTML templates](customize-ui-with-html.md). When using HTML templates, provide an absolute URL. The following example illustrates a content definition with HTML template:
@@ -98,8 +98,8 @@ The **DataUri** element is used to specify the page identifier. Azure AD B2C use
98
98
| Page identifier | Description |
99
99
| ----- | ----------- |
100
100
|`globalexception`| Displays an error page when an exception or an error is encountered. |
101
-
|`providerselection`, `idpselection`|Lists the identity providers that users can choose from during sign-in. |
102
-
|`unifiedssp`| Displays a form for signing in with a local account that's based on an email address or a user name. This value also provides the “keep me sign-in functionality” and “Forgot your password?” link. |
101
+
|`providerselection`, `idpselection`|Lists the identity providers that users can choose from during sign-in. |
102
+
|`unifiedssp`| Displays a form for signing in with a local account that's based on an email address or a user name. This value also provides the "keep me sign-in functionality" and "Forgot your password?" link. |
103
103
|`unifiedssd`| Displays a form for signing in with a local account that's based on an email address or a username. This page identifier is deprecated. Use the `unifiedssp` page identifier instead. |
104
104
|`multifactor`| Verifies phone numbers by using text or voice during sign-up or sign-in. |
105
105
|`selfasserted`| Displays a form to collect data from a user. For example, enables users to create or update their profile. |
@@ -108,7 +108,7 @@ The **DataUri** element is used to specify the page identifier. Azure AD B2C use
108
108
109
109
You can enable [JavaScript client-side code](javascript-and-page-layout.md) by inserting `contract` between `elements` and the page type. For example, `urn:com:microsoft:aad:b2c:elements:contract:page-name:version`.
110
110
111
-
The [version](page-layout.md) part of the `DataUri` specifies the package of content containing HTML, CSS, and JavaScript for the user interface elements in your policy. If you intend to enable JavaScript client-side code, the elements you base your JavaScript on must be immutable. If they're not immutable, any changes could cause unexpected behavior on your user pages. To prevent these issues, enforce the use of a page layout and specify a page layout version. Doing so ensures that all content definitions you’ve based your JavaScript on are immutable. Even if you don’t intend to enable JavaScript, you still need to specify the page layout version for your pages.
111
+
The [version](page-layout.md) part of the `DataUri` specifies the package of content containing HTML, CSS, and JavaScript for the user interface elements in your policy. If you intend to enable JavaScript client-side code, the elements you base your JavaScript on must be immutable. If they're not immutable, any changes could cause unexpected behavior on your user pages. To prevent these issues, enforce the use of a page layout and specify a page layout version. Doing so ensures that all content definitions you've based your JavaScript on are immutable. Even if you don't intend to enable JavaScript, you still need to specify the page layout version for your pages.
112
112
113
113
The following example shows the **DataUri** of `selfasserted` version `1.2.0`:
114
114
@@ -146,7 +146,7 @@ To migrate from the old **DataUri** value (without page contract) to page layout
0 commit comments