You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Azure Active Directory B2C (Azure AD B2C) provides support for verifying an email address for self-service password reset (SSPR). Use the Azure AD SSPR technical profile to generate and send a code to an email address, and then verify the code. The Azure AD SSPR technical profile may also return an error message. The validation technical profile validates the user-provided data before the user journey continues. With the validation technical profile, an error message displays on a self-asserted page.
22
+
Azure Active Directory B2C (Azure AD B2C) provides support for verifying an email address for self-service password reset (SSPR). Use the Microsoft Entra SSPR technical profile to generate and send a code to an email address, and then verify the code. The Microsoft Entra SSPR technical profile may also return an error message. The validation technical profile validates the user-provided data before the user journey continues. With the validation technical profile, an error message displays on a self-asserted page.
23
23
24
24
This technical profile:
25
25
26
26
- Doesn't provide an interface to interact with the user. Instead, the user interface is called from a [self-asserted](self-asserted-technical-profile.md) technical profile, or a [display control](display-controls.md) as a [validation technical profile](validation-technical-profile.md).
27
-
- Uses the Azure AD SSPR service to generate and send a code to an email address, and then verifies the code.
27
+
- Uses the Microsoft Entra SSPR service to generate and send a code to an email address, and then verifies the code.
28
28
- Validates an email address via a verification code.
29
29
30
30
## Protocol
@@ -35,7 +35,7 @@ The **Name** attribute of the **Protocol** element needs to be set to `Proprieta
The following example shows an Azure AD SSPR technical profile:
38
+
The following example shows a Microsoft Entra SSPR technical profile:
39
39
40
40
```xml
41
41
<TechnicalProfileId="AadSspr-SendCode">
@@ -50,17 +50,17 @@ The first mode of this technical profile is to generate a code and send it. The
50
50
51
51
### Input claims
52
52
53
-
The **InputClaims** element contains a list of claims to send to Azure AD SSPR. You can also map the name of your claim to the name defined in the SSPR technical profile.
53
+
The **InputClaims** element contains a list of claims to send to Microsoft Entra SSPR. You can also map the name of your claim to the name defined in the SSPR technical profile.
54
54
55
55
| ClaimReferenceId | Required | Description |
56
56
| --------- | -------- | ----------- |
57
57
| emailAddress | Yes | The identifier for the user who owns the email address. The `PartnerClaimType` property of the input claim must be set to `emailAddress`. |
58
58
59
-
The **InputClaimsTransformations** element may contain a collection of **InputClaimsTransformation** elements that are used to modify the input claims or generate new ones before sending to the Azure AD SSPR service.
59
+
The **InputClaimsTransformations** element may contain a collection of **InputClaimsTransformation** elements that are used to modify the input claims or generate new ones before sending to the Microsoft Entra SSPR service.
60
60
61
61
### Output claims
62
62
63
-
The Azure AD SSPR protocol provider does not return any **OutputClaims**, thus there is no need to specify output claims. You can, however, include claims that aren't returned by the Azure AD SSPR protocol provider as long as you set the `DefaultValue` attribute.
63
+
The Microsoft Entra SSPR protocol provider does not return any **OutputClaims**, thus there is no need to specify output claims. You can, however, include claims that aren't returned by the Microsoft Entra SSPR protocol provider as long as you set the `DefaultValue` attribute.
64
64
65
65
The **OutputClaimsTransformations** element may contain a collection of **OutputClaimsTransformation** elements that are used to modify the output claims or generate new ones.
66
66
@@ -81,7 +81,7 @@ The following metadata can be used to configure the error messages displayed upo
81
81
82
82
### Example: send an email
83
83
84
-
The following example shows an Azure AD SSPR technical profile that is used to send a code via email.
84
+
The following example shows a Microsoft Entra SSPR technical profile that is used to send a code via email.
85
85
86
86
```xml
87
87
<TechnicalProfileId="AadSspr-SendCode">
@@ -102,18 +102,18 @@ The second mode of this technical profile is to verify a code. The following opt
102
102
103
103
### Input claims
104
104
105
-
The **InputClaims** element contains a list of claims to send to Azure AD SSPR. You can also map the name of your claim to the name defined in the SSPR technical profile.
105
+
The **InputClaims** element contains a list of claims to send to Microsoft Entra SSPR. You can also map the name of your claim to the name defined in the SSPR technical profile.
| emailAddress| Yes | Same email address as previously used to send a code. It is also used to locate an email verification session. The `PartnerClaimType` property of the input claim must be set to `emailAddress`.|
110
110
| verificationCode | Yes | The verification code provided by the user to be verified. The `PartnerClaimType` property of the input claim must be set to `verificationCode`. |
111
111
112
-
The **InputClaimsTransformations** element may contain a collection of **InputClaimsTransformation** elements that are used to modify the input claims or generate new ones before calling the Azure AD SSPR service.
112
+
The **InputClaimsTransformations** element may contain a collection of **InputClaimsTransformation** elements that are used to modify the input claims or generate new ones before calling the Microsoft Entra SSPR service.
113
113
114
114
### Output claims
115
115
116
-
The Azure AD SSPR protocol provider does not return any **OutputClaims**, thus there is no need to specify output claims. You can, however, include claims that aren't returned by the Azure AD SSPR protocol provider as long as you set the `DefaultValue` attribute.
116
+
The Microsoft Entra SSPR protocol provider does not return any **OutputClaims**, thus there is no need to specify output claims. You can, however, include claims that aren't returned by the Microsoft Entra SSPR protocol provider as long as you set the `DefaultValue` attribute.
117
117
118
118
The **OutputClaimsTransformations** element may contain a collection of **OutputClaimsTransformation** elements that are used to modify the output claims or generate new ones.
119
119
@@ -137,7 +137,7 @@ The following metadata can be used to configure the error messages displayed upo
137
137
138
138
### Example: verify a code
139
139
140
-
The following example shows an Azure AD SSPR technical profile used to verify the code.
140
+
The following example shows a Microsoft Entra SSPR technical profile used to verify the code.
Copy file name to clipboardExpand all lines: articles/active-directory-b2c/access-tokens.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -20,7 +20,7 @@ An *access token* contains claims that you can use in Azure Active Directory B2C
20
20
This article shows you how to request an access token for a web application and web API. For more information about tokens in Azure AD B2C, see the [overview of tokens in Azure Active Directory B2C](tokens-overview.md).
21
21
22
22
> [!NOTE]
23
-
> **Web API chains (On-Behalf-Of) is not supported by Azure AD B2C** - Many architectures include a web API that needs to call another downstream web API, both secured by Azure AD B2C. This scenario is common in clients that have a web API back end, which in turn calls a another service. This chained web API scenario can be supported by using the OAuth 2.0 JWT Bearer Credential grant, otherwise known as the On-Behalf-Of flow. However, the On-Behalf-Of flow is not currently implemented in Azure AD B2C. Although On-Behalf-Of works for applications registered in Azure AD, it does not work for applications registered in Azure AD B2C, regardless of the tenant (Azure AD or Azure AD B2C) that is issuing the tokens.
23
+
> **Web API chains (On-Behalf-Of) is not supported by Azure AD B2C** - Many architectures include a web API that needs to call another downstream web API, both secured by Azure AD B2C. This scenario is common in clients that have a web API back end, which in turn calls a another service. This chained web API scenario can be supported by using the OAuth 2.0 JWT Bearer Credential grant, otherwise known as the On-Behalf-Of flow. However, the On-Behalf-Of flow is not currently implemented in Azure AD B2C. Although On-Behalf-Of works for applications registered in Microsoft Entra ID, it does not work for applications registered in Azure AD B2C, regardless of the tenant (Microsoft Entra ID or Azure AD B2C) that is issuing the tokens.
0 commit comments