You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
title: Tutorial to configure Azure Active Directory B2C with Microsoft Dynamics 365 Fraud Protection
3
3
titleSuffix: Azure AD B2C
4
-
description: Tutorial to configure Azure Active Directory B2C with Microsoft Dynamics 365 Fraud Protection to identify risky and fraudulent account
4
+
description: Tutorial to configure Azure AD B2C with Microsoft Dynamics 365 Fraud Protection to identify risky and fraudulent accounts
5
5
services: active-directory-b2c
6
6
author: gargi-sinha
7
-
manager: CelesteDG
7
+
manager: martinco
8
8
ms.reviewer: kengaderdus
9
-
10
9
ms.service: active-directory
11
10
ms.workload: identity
12
11
ms.topic: how-to
13
-
ms.date: 08/28/2022
12
+
ms.date: 11/29/2022
14
13
ms.author: gasinh
15
14
ms.subservice: B2C
16
15
---
17
16
18
17
# Tutorial: Configure Microsoft Dynamics 365 Fraud Protection with Azure Active Directory B2C
19
18
20
-
In this sample tutorial, learn how to integrate [Microsoft Dynamics 365 Fraud Protection](/dynamics365/fraud-protection/ap-overview) (DFP) with Azure Active Directory (AD) B2C.
19
+
Organizations can use Microsoft Dynamics 365 Fraud Protection (DFP) to assess risk during attempts to create fraudulent accounts and sign-ins. Customers use Microsoft DFP assessment to block or challenge suspicious attempts to create new, fake accounts, or to compromise accounts.
21
20
22
-
Microsoft DFP provides organizations with the capability to assess the risk of attempts to create fraudulent accounts and log-ins. Microsoft DFP assessment can be used by the customer to block or challenge suspicious attempts to create new fake accounts or to compromise existing accounts.
21
+
In this tutorial, learn how to integrate Microsoft DFP with Azure Active Directory B2C (Azure AD B2C). There's guidance on how to incorporate the Microsoft DFP device fingerprinting and account creation, and sign-in assessment API endpoints, into an Azure AD B2C custom policy.
23
22
24
-
This sample demonstrates how to incorporate the Microsoft DFP device fingerprinting and account creation and sign-in assessment API endpoints into an Azure AD B2C custom policy.
23
+
Learn more: [Overview of Microsoft Dynamics 365 Fraud Protection](/dynamics365/fraud-protection/)
25
24
26
25
## Prerequisites
27
26
28
27
To get started, you'll need:
29
28
30
-
- An Azure subscription. If you don't have a subscription, you can get a [free account](https://azure.microsoft.com/free/).
31
-
32
-
- An [Azure AD B2C tenant](./tutorial-create-tenant.md). Tenant is linked to your Azure subscription.
33
-
34
-
- Get a Microsoft DFP [subscription](https://dynamics.microsoft.com/pricing/#Sales). You can set up a [trial client version](https://dynamics.microsoft.com/ai/fraud-protection/signin/?RU=https%3A%2F%2Fdfp.microsoft.com%2Fsignin) as well.
29
+
- An Azure subscription
30
+
- If you don't have one, you can get an [Azure free account](https://azure.microsoft.com/free/)
31
+
- An [Azure AD B2C tenant](./tutorial-create-tenant.md) linked to your Azure subscription
32
+
- A Microsoft DFP subscription
33
+
- See, [Dynamics 365 pricing](https://dynamics.microsoft.com/pricing/#Sales)
34
+
- You can set up a [trial client version](https://dynamics.microsoft.com/ai/fraud-protection/signin/?RU=https%3A%2F%2Fdfp.microsoft.com%2Fsignin)
35
35
36
36
## Scenario description
37
37
38
38
Microsoft DFP integration includes the following components:
39
39
40
-
-**Azure AD B2C tenant**: Authenticates the user and acts as a client of Microsoft DFP. Hosts a fingerprinting script collecting identification and diagnostic data of every user that executes a target policy. Later blocks or challenges sign-in or sign-up attempts based on the rule evaluation result returned by Microsoft DFP.
41
-
42
-
-**Custom UI templates**: Used to customize the HTML content of the pages rendered by Azure AD B2C. These pages include the JavaScript snippet required for Microsoft DFP fingerprinting
43
-
44
-
-**Microsoft DFP fingerprinting service**: Dynamically embedded script, which logs device telemetry and self-asserted user details to create a uniquely identifiable fingerprint for the user to be used later in the decision-making process.
45
-
46
-
-**Microsoft DFP API endpoints**: Provides the decision result and accepts a final status reflecting the operation undertaken by the client application. Azure AD B2C communicates directly with the Microsoft DFP endpoints using REST API connectors. API authentication occurs via a client_credentials grant to the Azure AD tenant in which Microsoft DFP is licensed and installed to obtain a bearer token.
40
+
-**Azure AD B2C tenant**: Authenticates the user and acts as a client of Microsoft DFP. Hosts a fingerprinting script collecting identification and diagnostic data of users who execute a target policy. It blocks or challenges sign-in or sign-up attempts based on the rule evaluation result returned by Microsoft DFP.
41
+
-**Custom UI templates**: Customizes HTML content of the pages rendered by Azure AD B2C. These pages include the JavaScript snippet required for Microsoft DFP fingerprinting.
42
+
-**Microsoft DFP fingerprinting service**: Dynamically embedded script that logs device telemetry and self-asserted user details to create a uniquely identifiable fingerprint for the user.
43
+
-**Microsoft DFP API endpoints**: Provides the decision result and accepts a final status reflecting the operation undertaken by the client application. Azure AD B2C communicates with the Microsoft DFP endpoints using REST API connectors. API authentication occurs with a client_credentials grant to the Azure AD tenant in which Microsoft DFP is licensed and installed to obtain a bearer token.
47
44
48
45
The following architecture diagram shows the implementation.
49
46
50
-
47
+
51
48
52
-
|Step | Description |
53
-
|:-----| :-----------|
54
-
| 1. | The user arrives at a login page. Users select sign-up to create a new account and enter information into the page. Azure AD B2C collects user attributes.
55
-
| 2. | Azure AD B2C calls the Microsoft DFP API and passes on the user attributes.
56
-
| 3. | After Microsoft DFP API consumes the information and processes it, it returns the result to Azure AD B2C.
57
-
| 4. | Azure AD B2C receives information back from the Microsoft DFP API. If it shows a Failure response, an error message is displayed to the user. If it shows a Success response, the user is authenticated and written into the directory.
49
+
1. The user arrives at a sign-in page, selects option to create a new account, and enters information. Azure AD B2C collects user attributes.
50
+
2. Azure AD B2C calls the Microsoft DFP API and passes the user attributes.
51
+
3. After Microsoft DFP API consumes the information and processes it, it returns the result to Azure AD B2C.
52
+
4. Azure AD B2C receives information from the Microsoft DFP API. If failure occurs, an error message appears. With success, the user is authenticated and written into the directory.
58
53
59
54
## Set up the solution
60
55
@@ -67,12 +62,12 @@ The following architecture diagram shows the implementation.
67
62
68
63
## Set up your custom domain
69
64
70
-
In a production environment, you must use a [custom domain for Azure AD B2C](./custom-domain.md?pivots=b2c-custom-policy) and for the [Microsoft DFP fingerprinting service](/dynamics365/fraud-protection/device-fingerprinting#set-up-dns). The domain for both services should be in the same root DNS zone to prevent browser privacy settings from blocking cross-domain cookies, isn't necessary in a non-production environment.
65
+
In a production environment, use a [custom domain for Azure AD B2C](./custom-domain.md?pivots=b2c-custom-policy) and for the [Microsoft DFP fingerprinting service](/dynamics365/fraud-protection/device-fingerprinting#set-up-dns). The domain for both services is in the same root DNS zone to prevent browser privacy settings from blocking cross-domain cookies. This configuration isn't necessary in a non-production environment.
71
66
72
-
Following is an example:
67
+
See the following table for examples of environment, service, and domain.
73
68
74
69
| Environment | Service | Domain |
75
-
|:------------|:---------------|:---------------|
70
+
|---|---|---|
76
71
| Development | Azure AD B2C |`contoso-dev.b2clogin.com`|
77
72
| Development | Microsoft DFP Fingerprinting |`fpt.dfp.microsoft-int.com`|
78
73
| UAT | Azure AD B2C |`contoso-uat.b2clogin.com`|
@@ -83,94 +78,81 @@ Following is an example:
83
78
## Deploy the UI templates
84
79
85
80
1. Deploy the provided [Azure AD B2C UI templates](https://github.com/azure-ad-b2c/partner-integrations/tree/master/samples/Dynamics-Fraud-Protection/ui-templates) to a public facing internet hosting service such as Azure Blob Storage.
86
-
87
81
2. Replace the value `https://<YOUR-UI-BASE-URL>/` with the root URL for your deployment location.
88
82
89
-
>[!NOTE]
90
-
>You'll later need the base URL to configure the Azure AD B2C policies.
83
+
>[!NOTE]
84
+
>Later, you'll need the base URL to configure Azure AD B2C policies.
91
85
92
86
3. In the `ui-templates/js/dfp.js` file, replace `<YOUR-DFP-INSTANCE-ID>` with your Microsoft DFP instance ID.
93
-
94
87
4. Ensure CORS is enabled for your Azure AD B2C domain name `https://{your_tenant_name}.b2clogin.com` or `your custom domain`.
95
88
96
-
See [UI customization documentation](./customize-ui-with-html.md?pivots=b2c-custom-policy) to learn more.
### Add policy keys for your Microsoft DFP client app ID and secret
101
94
102
95
1. In the Azure AD tenant where Microsoft DFP is set up, create an [Azure AD application and grant admin consent](/dynamics365/fraud-protection/integrate-real-time-api#create-azure-active-directory-applications).
103
-
2. Create a secret value for this application registration and note the application's client ID and client secret value.
96
+
2. Create a secret value for this application registration. Note the application client ID and client secret value.
104
97
3. Save the client ID and client secret values as [policy keys in your Azure AD B2C tenant](./policy-keys-overview.md).
105
98
106
-
>[!NOTE]
107
-
>You'll later need the policy keys to configure your Azure AD B2C policies.
99
+
>[!NOTE]
100
+
>Later, you'll need the policy keys to configure Azure AD B2C policies.
108
101
109
102
### Replace the configuration values
110
103
111
104
In the provided [custom policies](https://github.com/azure-ad-b2c/partner-integrations/tree/master/samples/Dynamics-Fraud-Protection/policies), find the following placeholders and replace them with the corresponding values from your instance.
112
105
113
106
| Placeholder | Replace with | Notes |
114
-
|:--------|:------------| :-----------|
115
-
|{Settings:Production}|Whether to deploy the policies in production mode |`true` or `false`|
116
-
|{Settings:Tenant}|Your tenant short name |`your-tenant` - from your-tenant.onmicrosoft.com|
117
-
|{Settings:DeploymentMode}|Application Insights deployment mode to use|`Production` or `Development`|
118
-
|{Settings:DeveloperMode}|Whether to deploy the policies in Application Insights developer mode|`true` or `false`|
119
-
|{Settings:AppInsightsInstrumentationKey}|Instrumentation key of your Application Insights instance*|`01234567-89ab-cdef-0123-456789abcdef`|
120
-
|{Settings:IdentityExperienceFrameworkAppId}|App ID of the IdentityExperienceFramework app configured in your Azure AD B2C tenant|`01234567-89ab-cdef-0123-456789abcdef`|
121
-
|{Settings:ProxyIdentityExperienceFrameworkAppId}|App ID of the ProxyIdentityExperienceFramework app configured in your Azure AD B2C tenant|`01234567-89ab-cdef-0123-456789abcdef`|
122
-
|{Settings:FacebookClientId}|App ID of the Facebook app you configured for federation with B2C|`000000000000000`|
123
-
|{Settings:FacebookClientSecretKeyContainer}| Name of the policy key-in which you saved Facebook's app secret |`B2C_1A_FacebookAppSecret`|
124
-
|{Settings:ContentDefinitionBaseUri}|Endpoint in where you deployed the UI files|`https://<my-storage-account>.blob.core.windows.net/<my-storage-container>`|
125
-
|{Settings:DfpApiBaseUrl}|The base path for your DFP API instance - found in the DFP portal|`https://tenantname-01234567-89ab-cdef-0123-456789abcdef.api.dfp.dynamics.com/v1.0/`|
126
-
|{Settings:DfpApiAuthScope}|The client_credentials scope for the DFP API service|`https://api.dfp.dynamics-int.com/.default or https://api.dfp.dynamics.com/.default`|
127
-
|{Settings:DfpTenantId}|The ID of the Azure AD tenant (not B2C) where DFP is licensed and installed|`01234567-89ab-cdef-0123-456789abcdef` or `consoto.onmicrosoft.com`|
128
-
|{Settings:DfpAppClientIdKeyContainer}|Name of the policy key-in which you save the DFP client ID|`B2C_1A_DFPClientId`|
129
-
|{Settings:DfpAppClientSecretKeyContainer}|Name of the policy key-in which you save the DFP client secret |`B2C_1A_DFPClientSecret`|
130
-
131
-
*Application insights can be set up in any Azure AD tenant/subscription. This value is optional but [recommended to assist with debugging](./troubleshoot-with-application-insights.md).
107
+
| --- | ---|---|
108
+
|{Settings:Production}|Whether to deploy the policies in production mode |`true` or `false`|
109
+
|{Settings:Tenant}|Your tenant short name |`your-tenant` - from your-tenant.onmicrosoft.com|
110
+
|{Settings:DeploymentMode}|Application Insights deployment mode to use|`Production` or `Development`|
111
+
|{Settings:DeveloperMode}|Whether to deploy the policies in Application Insights developer mode|`true` or `false`|
112
+
|{Settings:AppInsightsInstrumentationKey}|Instrumentation key of your Application Insights instance*|`01234567-89ab-cdef-0123-456789abcdef`|
113
+
|{Settings:IdentityExperienceFrameworkAppId}App ID of the IdentityExperienceFramework app configured in your Azure AD B2C tenant|`01234567-89ab-cdef-0123-456789abcdef`|
114
+
|{Settings:ProxyIdentityExperienceFrameworkAppId}|App ID of the ProxyIdentityExperienceFramework app configured in your Azure AD B2C tenant|`01234567-89ab-cdef-0123-456789abcdef`|
115
+
|{Settings:FacebookClientId}|App ID of the Facebook app you configured for federation with B2C|`000000000000000`|
116
+
|{Settings:FacebookClientSecretKeyContainer}| Name of the policy key, in which you saved Facebook's app secret |`B2C_1A_FacebookAppSecret`|
117
+
|{Settings:ContentDefinitionBaseUri}|Endpoint in where you deployed the UI files|`https://<my-storage-account>.blob.core.windows.net/<my-storage-container>`|
118
+
|{Settings:DfpApiBaseUrl}|The base path for your DFP API instance, found in the DFP portal|`https://tenantname-01234567-89ab-cdef-0123-456789abcdef.api.dfp.dynamics.com/v1.0/`|
119
+
|{Settings:DfpApiAuthScope}|The client_credentials scope for the DFP API service|`https://api.dfp.dynamics-int.com/.default or https://api.dfp.dynamics.com/.default`|
120
+
|{Settings:DfpTenantId}|The ID of the Azure AD tenant (not B2C) where DFP is licensed and installed|`01234567-89ab-cdef-0123-456789abcdef` or `consoto.onmicrosoft.com`|
121
+
|{Settings:DfpAppClientIdKeyContainer}|Name of the policy key-in which you save the DFP client ID|`B2C_1A_DFPClientId`|
122
+
|{Settings:DfpAppClientSecretKeyContainer}|Name of the policy key-in which you save the DFP client secret |`B2C_1A_DFPClientSecret`|
123
+
124
+
*You can set up application insights in an Azure AD tenant or subscription. This value is optional but [recommended to assist with debugging](./troubleshoot-with-application-insights.md).
132
125
133
126
>[!NOTE]
134
-
>Add consent notification to the attribute collection page. Notify that the users' telemetry and user identity information will be recorded for account protection purposes.
127
+
>Add consent notification to the attribute collection page. Include notification that user telemetry and identity information is recorded for account protection.
135
128
136
129
## Configure the Azure AD B2C policy
137
130
138
131
1. Go to the [Azure AD B2C policy](https://github.com/azure-ad-b2c/partner-integrations/tree/master/samples/Dynamics-Fraud-Protection/policies) in the Policies folder.
139
-
140
-
2. Follow this [document](./tutorial-create-user-flows.md?pivots=b2c-custom-policy?tabs=applications#custom-policy-starter-pack) to download [LocalAccounts starter pack](https://github.com/Azure-Samples/active-directory-b2c-custom-policy-starterpack/tree/master/LocalAccounts)
141
-
132
+
2. Follow the instructions in [custom policy starter pack](./tutorial-create-user-flows.md?pivots=b2c-custom-policy?tabs=applications#custom-policy-starter-pack) to download the [LocalAccounts starter pack](https://github.com/Azure-Samples/active-directory-b2c-custom-policy-starterpack/tree/master/LocalAccounts).
142
133
3. Configure the policy for the Azure AD B2C tenant.
143
134
144
135
>[!NOTE]
145
-
>Update the policies provided to relate to your specific tenant.
136
+
>Update the provided policies to relate to your tenant.
146
137
147
138
## Test the user flow
148
139
149
140
1. Open the Azure AD B2C tenant and under Policies select **Identity Experience Framework**.
150
-
151
141
2. Select your previously created **SignUpSignIn**.
142
+
3. Select **Run user flow**.
143
+
4.**Application**: The registered app (example is JWT).
144
+
5.**Reply URL**: **redirect URL**.
145
+
6. Select **Run user flow**.
146
+
7. Complete the sign-up flow and create an account.
152
147
153
-
3. Select **Run user flow** and select the settings:
154
-
155
-
a. **Application**: select the registered app (sample is JWT)
156
-
157
-
b. **Reply URL**: select the **redirect URL**
158
-
159
-
c. Select **Run user flow**.
160
-
161
-
4. Go through sign-up flow and create an account
162
-
163
-
5. Microsoft DFP service will be called during the flow, after user attribute is created. If the flow is incomplete, check that the user isn't saved in the directory.
148
+
>[!TIP]
149
+
>Microsoft DFP is called during the flow. If the flow is incomplete, confirm the user isn't saved in the directory.
164
150
165
151
>[!NOTE]
166
-
>Update rules directly in Microsoft DFP Portal if using [Microsoft DFP rule engine](/dynamics365/fraud-protection/rules).
152
+
>If using [Microsoft DFP rule engine](/dynamics365/fraud-protection/rules), update rules in the Microsoft DFP portal.
167
153
168
154
## Next steps
169
155
170
-
For additional information, review the following articles:
0 commit comments