|
| 1 | +--- |
| 2 | +title: Define a phone factor technical profile in a custom policy |
| 3 | +titleSuffix: Azure AD B2C |
| 4 | +description: Define a phone factor technical profile in a custom policy in Azure Active Directory B2C. |
| 5 | +services: active-directory-b2c |
| 6 | +author: msmimart |
| 7 | +manager: celestedg |
| 8 | + |
| 9 | +ms.service: active-directory |
| 10 | +ms.workload: identity |
| 11 | +ms.topic: reference |
| 12 | +ms.date: 03/20/2020 |
| 13 | +ms.author: mimart |
| 14 | +ms.subservice: B2C |
| 15 | +--- |
| 16 | + |
| 17 | +# Define a phone factor technical profile in an Azure Active Directory B2C custom policy |
| 18 | + |
| 19 | +[!INCLUDE [active-directory-b2c-advanced-audience-warning](../../includes/active-directory-b2c-advanced-audience-warning.md)] |
| 20 | + |
| 21 | +Azure Active Directory B2C (Azure AD B2C) provides support for enrolling and verifying phone numbers. This technical profile: |
| 22 | + |
| 23 | +- Provides a user interface to interact with the user. |
| 24 | +- Uses content definition to control the look and feel. |
| 25 | +- Supports both phone calls and text messages to validate the phone number. |
| 26 | +- Supports multiple phone numbers. The user can select one of the phone numbers to verify. |
| 27 | +- If a phone number is provided, the phone factor user interface asks the user to verify the phone number. If not provided, it asks the user to enroll a new phone number. |
| 28 | +- Returns a claim indicating whether the user provided a new phone number. You can use this claim to decide whether the phone number should be persisted to the Azure AD user profile. |
| 29 | + |
| 30 | +## Protocol |
| 31 | + |
| 32 | +The **Name** attribute of the **Protocol** element needs to be set to `Proprietary`. The **handler** attribute must contain the fully qualified name of the protocol handler assembly that is used by Azure AD B2C for phone factor: |
| 33 | +`Web.TPEngine.Providers.PhoneFactorProtocolProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null` |
| 34 | + |
| 35 | +The following example shows a phone factor technical profile for enrollment and validation: |
| 36 | + |
| 37 | +```XML |
| 38 | +<TechnicalProfile Id="PhoneFactor-InputOrVerify"> |
| 39 | + <DisplayName>PhoneFactor</DisplayName> |
| 40 | + <Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.PhoneFactorProtocolProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" /> |
| 41 | +</TechnicalProfile> |
| 42 | +``` |
| 43 | + |
| 44 | +## Input claims |
| 45 | + |
| 46 | +The InputClaims element must contain following claims. You can also map the name of your claim to the name defined in the phone factor technical profile. |
| 47 | + |
| 48 | +```XML |
| 49 | +<InputClaims> |
| 50 | + <!--A unique identifier of the user. The partner claim type must be set to `UserId`. --> |
| 51 | + <InputClaim ClaimTypeReferenceId="userIdForMFA" PartnerClaimType="UserId" /> |
| 52 | + <!--A claim that contains the phone number. If the claim is empty, Azure AD B2C asks the user to enroll a new phone number. Otherwise, it asks the user to verify the phone number. --> |
| 53 | + <InputClaim ClaimTypeReferenceId="strongAuthenticationPhoneNumber" /> |
| 54 | +</InputClaims> |
| 55 | +``` |
| 56 | + |
| 57 | +The following example demonstrates using multiple phone numbers. For more information, see [sample policy](https://github.com/azure-ad-b2c/samples/tree/master/policies/mfa-add-secondarymfa). |
| 58 | + |
| 59 | +```XML |
| 60 | +<InputClaims> |
| 61 | + <InputClaim ClaimTypeReferenceId="userIdForMFA" PartnerClaimType="UserId" /> |
| 62 | + <InputClaim ClaimTypeReferenceId="strongAuthenticationPhoneNumber" /> |
| 63 | + <InputClaim ClaimTypeReferenceId="secondaryStrongAuthenticationPhoneNumber" /> |
| 64 | +</InputClaims> |
| 65 | +``` |
| 66 | + |
| 67 | +The InputClaimsTransformations element may contain a collection of InputClaimsTransformation elements that are used to modify the input claims or generate new ones before presenting them to the phone factor page. |
| 68 | + |
| 69 | +## Output claims |
| 70 | + |
| 71 | +The OutputClaims element contains a list of claims returned by the phone factor technical profile. |
| 72 | + |
| 73 | +```xml |
| 74 | +<OutputClaims> |
| 75 | + <!-- The verified phone number. The partner claim type must be set to `Verified.OfficePhone`. --> |
| 76 | + <OutputClaim ClaimTypeReferenceId="Verified.strongAuthenticationPhoneNumber" PartnerClaimType="Verified.OfficePhone" /> |
| 77 | + <!-- Indicates whether the new phone number has been entered by the user. The partner claim type must be set to `newPhoneNumberEntered`. --> |
| 78 | + <OutputClaim ClaimTypeReferenceId="newPhoneNumberEntered" PartnerClaimType="newPhoneNumberEntered" /> |
| 79 | +</OutputClaims> |
| 80 | +``` |
| 81 | + |
| 82 | +The OutputClaimsTransformations element may contain a collection of OutputClaimsTransformation elements that are used to modify the output claims or generate new ones. |
| 83 | + |
| 84 | +## Cryptographic keys |
| 85 | + |
| 86 | +The **CryptographicKeys** element is not used. |
| 87 | + |
| 88 | + |
| 89 | +## Metadata |
| 90 | + |
| 91 | +| Attribute | Required | Description | |
| 92 | +| --------- | -------- | ----------- | |
| 93 | +| ContentDefinitionReferenceId | Yes | The identifier of the [content definition](contentdefinitions.md) associated with this technical profile. | |
| 94 | +| ManualPhoneNumberEntryAllowed| No | Specify whether or not a user is allowed to manually enter a phone number. Possible values: `true` or `false` (default).| |
| 95 | + |
| 96 | +## Next steps |
| 97 | + |
| 98 | +- Check the [social and local accounts with MFA](https://github.com/Azure-Samples/active-directory-b2c-custom-policy-starterpack/tree/master/SocialAndLocalAccountsWithMfa) starter pack. |
| 99 | + |
0 commit comments