|
| 1 | +--- |
| 2 | +title: Tutorial to configure Azure Active Directory B2C with Microsoft Dynamics 365 Fraud Protection |
| 3 | +titleSuffix: Azure AD B2C |
| 4 | +description: Tutorial to configure Azure Active Directory B2C with Microsoft Dynamics 365 Fraud Protection to identify risky and fraudulent account |
| 5 | +services: active-directory-b2c |
| 6 | +author: gargi-sinha |
| 7 | +manager: martinco |
| 8 | + |
| 9 | +ms.service: active-directory |
| 10 | +ms.workload: identity |
| 11 | +ms.topic: how-to |
| 12 | +ms.date: 02/10/2021 |
| 13 | +ms.author: gasinh |
| 14 | +ms.subservice: B2C |
| 15 | +--- |
| 16 | + |
| 17 | +# Tutorial: Configure Microsoft Dynamics 365 Fraud Protection with Azure Active Directory B2C |
| 18 | + |
| 19 | +In this sample tutorial, we provide guidance on how to integrate [Microsoft Dynamics 365 Fraud Protection](https://docs.microsoft.com/dynamics365/fraud-protection/overview) (DFP) with the Azure Active Directory (AD) B2C. |
| 20 | + |
| 21 | +Microsoft DFP provides clients with the capability to assess if the risk of attempts to create new accounts and attempts to login to client’s ecosystem are fraudulent. Microsoft DFP assessment can be used by the customer to block or challenge suspicious attempts to create new fake accounts or to compromise existing accounts. Account protection includes artificial intelligence empowered device fingerprinting, APIs for real-time risk assessment, rule and list experience to optimize risk strategy as per client’s business needs, and a scorecard to monitor fraud protection effectiveness and trends in client’s ecosystem. |
| 22 | + |
| 23 | +In this sample, we'll be integrating the account protection features of Microsoft DFP with an Azure AD B2C user flow. The service will externally fingerprint every sign-in or sign up attempt and watch for any past or present suspicious behavior. Azure AD B2C invokes a decision endpoint from Microsoft DFP, which returns a result based on all past and present behavior from the identified user, and also the custom rules specified within the Microsoft DFP service. Azure AD B2C makes an approval decision based on this result and passes the same back to Microsoft DFP. |
| 24 | + |
| 25 | +## Prerequisites |
| 26 | + |
| 27 | +To get started, you'll need: |
| 28 | + |
| 29 | +- An Azure subscription. If you don't have a subscription, you can get a [free account](https://azure.microsoft.com/free/). |
| 30 | + |
| 31 | +- An [Azure AD B2C tenant](https://docs.microsoft.com/azure/active-directory-b2c/tutorial-create-tenant). Tenant is linked to your Azure subscription. |
| 32 | + |
| 33 | +- Get a Microsoft DFP [subscription](https://dynamics.microsoft.com/pricing/#Sales). You can set up a [trial client version](https://dynamics.microsoft.com/ai/fraud-protection/signin/?RU=https%3A%2F%2Fdfp.microsoft.com%2Fsignin) as well. |
| 34 | + |
| 35 | +## Scenario description |
| 36 | + |
| 37 | +Microsoft DFP integration includes the following components: |
| 38 | + |
| 39 | +- **Azure AD B2C tenant**: Authenticates the user and acts as a client of Microsoft DFP. Hosts a fingerprinting script collecting identification and diagnostic data of every user that executes a target policy. Later blocks or challenges sign-in or sign-up attempts if Microsoft DFP finds them suspicious. |
| 40 | + |
| 41 | +- **Custom app service**: A web application that serves two purposes. |
| 42 | + |
| 43 | + - Serves HTML pages to be used as Identity Experience Framework's UI. Responsible for embedding the Microsoft Dynamics 365 fingerprinting script. |
| 44 | + |
| 45 | + - An API controller with RESTful endpoints that connects Microsoft DFP to Azure AD B2C. Handle's data processing, structure, and adheres to the security requirements of both. |
| 46 | + |
| 47 | +- **Microsoft DFP fingerprinting service**: Dynamically embedded script, which logs device telemetry and self-asserted user details to create a uniquely identifiable fingerprint for the user to be used later in the decision-making process. |
| 48 | + |
| 49 | +- **Microsoft DFP API endpoints**: Provides the decision result and accepts a final status reflecting the operation undertaken by the client application. Azure AD B2C doesn't communicate with the endpoints directly because of varying security and API payload requirements, instead uses the app service as an intermediate. |
| 50 | + |
| 51 | +The following architecture diagram shows the implementation. |
| 52 | + |
| 53 | + |
| 54 | + |
| 55 | +|Step | Description | |
| 56 | +|:-----| :-----------| |
| 57 | +| 1. | The user arrives at a login page. Users select sign-up to create a new account and enter information into the page. Azure AD B2C collects user attributes. |
| 58 | +| 2. | Azure AD B2C calls the middle layer API and passes on the user attributes. |
| 59 | +| 3. | Middle layer API collects user attributes and transforms it into a format that Microsoft DFP API could consume. Then after sends it to Microsoft DFP API. |
| 60 | +| 4. | After Microsoft DFP API consumes the information and processes it, it returns the result to the middle layer API. |
| 61 | +| 5. | The middle layer API processes the information and sends back relevant information to Azure AD B2C. |
| 62 | +| 6. | Azure AD B2C receives information back from the middle layer API. If it shows a Failure response, an error message is displayed to the user. If it shows a Success response, the user is authenticated and written into the directory. |
| 63 | + |
| 64 | +## Set up the solution |
| 65 | + |
| 66 | +1. [Create a Facebook application](https://docs.microsoft.com/azure/active-directory-b2c/identity-provider-facebook#create-a-facebook-application) configured to allow federation to Azure AD B2C. |
| 67 | +2. [Add the Facebook secret](https://docs.microsoft.com/azure/active-directory-b2c/custom-policy-get-started#create-the-facebook-key) you created as an Identity Experience Framework policy key. |
| 68 | + |
| 69 | +## Configure your application under Microsoft DFP |
| 70 | + |
| 71 | +[Set up your Azure AD tenant](https://docs.microsoft.com/dynamics365/fraud-protection/integrate-real-time-api) to use Microsoft DFP. |
| 72 | + |
| 73 | +## Deploy to the web application |
| 74 | + |
| 75 | +### Implement Microsoft DFP service fingerprinting |
| 76 | + |
| 77 | +[Microsoft DFP device fingerprinting](https://docs.microsoft.com/dynamics365/fraud-protection/device-fingerprinting) is a requirement for Microsoft DFP account protection. |
| 78 | + |
| 79 | +>[!NOTE] |
| 80 | +>In addition to Azure AD B2C UI pages, customer may also implement the fingerprinting service inside app code for more comprehensive device profiling. Fingerprinting service in app code is not included in this sample. |
| 81 | +
|
| 82 | +### Deploy the Azure AD B2C API code |
| 83 | + |
| 84 | +Deploy the [provided API code](https://github.com/azure-ad-b2c/partner-integrations/tree/master/samples/Dynamics-Fraud-Protection/API) to an Azure service. The code can be [published from Visual Studio](https://docs.microsoft.com/visualstudio/deployment/quickstart-deploy-to-azure?view=vs-2019). |
| 85 | + |
| 86 | +Set-up CORS, add **Allowed Origin** `https://{your_tenant_name}.b2clogin.com` |
| 87 | + |
| 88 | +>[!NOTE] |
| 89 | +>You'll later need the URL of the deployed service to configure Azure AD with the required settings. |
| 90 | +
|
| 91 | +See [App service documentation](https://docs.microsoft.com/azure/app-service/app-service-web-tutorial-rest-api) to learn more. |
| 92 | + |
| 93 | +### Add context-dependent configuration settings |
| 94 | + |
| 95 | +Configure the application settings in the [App service in Azure](https://docs.microsoft.com/azure/app-service/configure-common#configure-app-settings). This allows settings to be securely configured without checking them into a repository. The Rest API needs the following settings provided: |
| 96 | + |
| 97 | +| Application settings | Source | Notes | |
| 98 | +| :-------- | :------------| :-----------| |
| 99 | +|FraudProtectionSettings:InstanceId | Microsoft DFP Configuration | | |
| 100 | +|FraudProtectionSettings:DeviceFingerprintingCustomerId | Your Microsoft device fingerprinting customer ID | | |
| 101 | +| FraudProtectionSettings:ApiBaseUrl | Your Base URL from Microsoft DFP Portal | Remove '-int' to call the production API instead |
| 102 | +| TokenProviderConfig: Resource | https://api.dfp.dynamics-int.com | Remove '-int' to call the production API instead | |
| 103 | +| TokenProviderConfig:ClientId |Your Fraud Protection merchant Azure AD client app ID | | |
| 104 | +| TokenProviderConfig:Authority | https://login.microsoftonline.com/<directory_ID> | Your Fraud Protection merchant Azure AD tenant authority | |
| 105 | +| TokenProviderConfig:CertificateThumbprint* | The thumbprint of the certificate to use to authenticate against your merchant Azure AD client app | |
| 106 | +| TokenProviderConfig:ClientSecret* | The secret for your merchant Azure AD client app | Recommended to use a secrets manager | |
| 107 | + |
| 108 | +*Only set 1 of the 2 marked parameters depending on if you authenticate with a certificate or a secret such as a password. |
| 109 | + |
| 110 | +## Azure AD B2C configuration |
| 111 | + |
| 112 | +### Replace the configuration values |
| 113 | + |
| 114 | +In the provided [custom policies](https://github.com/azure-ad-b2c/partner-integrations/tree/master/samples/Dynamics-Fraud-Protection/Policies), find the following placeholders and replace them with the corresponding values from your instance. |
| 115 | + |
| 116 | +| Placeholder | Replace with | Notes | |
| 117 | +| :-------- | :------------| :-----------| |
| 118 | +|{your_tenant_name} | Your tenant short name | “yourtenant” from yourtenant.onmicrosoft.com | |
| 119 | +|{your_tenantId} | Tenant ID of your Azure AD B2C tenant | 01234567-89ab-cdef-0123-456789abcdef | |
| 120 | +| {your_tenant_IdentityExperienceFramework_appid} | App ID of the IdentityExperienceFramework app configured in your Azure AD B2C tenant | 01234567-89ab-cdef-0123-456789abcdef | |
| 121 | +| {your_tenant_ ProxyIdentityExperienceFramework _appid} | App ID of the ProxyIdentityExperienceFramework app configured in your Azure AD B2C tenant | 01234567-89ab-cdef-0123-456789abcdef | |
| 122 | +| {your_tenant_extensions_appid} | App ID of your tenant’s storage application | 01234567-89ab-cdef-0123-456789abcdef | |
| 123 | +| {your_tenant_extensions_app_objectid} | Object ID of your tenant’s storage application | 01234567-89ab-cdef-0123-456789abcdef | |
| 124 | +| {your_app_insights_instrumentation_key} | Instrumentation key of your app insights instance* | 01234567-89ab-cdef-0123-456789abcdef | |
| 125 | +| {your_ui_base_url} | Endpoint in your app service from where your UI files are served | https://yourapp.azurewebsites.net/B2CUI/GetUIPage | |
| 126 | +| {your_app_service_url} | URL of your app service | https://yourapp.azurewebsites.net | |
| 127 | +| {your-facebook-app-id} | App ID of the facebook app you configured for federation with Azure AD B2C | 000000000000000 | |
| 128 | +| {your-facebook-app-secret} | Name of the policy key you've saved facebook's app secret as | B2C_1A_FacebookAppSecret | |
| 129 | + |
| 130 | +*App insights can be in a different tenant. This step is optional. Remove the corresponding TechnicalProfiles and OrechestrationSteps if not needed. |
| 131 | + |
| 132 | +### Call Microsoft DFP label API |
| 133 | + |
| 134 | +Customers need to [implement label API](https://docs.microsoft.com/dynamics365/fraud-protection/integrate-ap-api). See [Microsoft DFP API](https://apidocs.microsoft.com/services/dynamics365fraudprotection#/AccountProtection/v1.0) to learn more. |
| 135 | + |
| 136 | +`URI: < API Endpoint >/v1.0/label/account/create/<userId>` |
| 137 | + |
| 138 | +The value of the userID needs to be the same as the one in the corresponding Azure AD B2C configuration value (ObjectID). |
| 139 | + |
| 140 | +>[!NOTE] |
| 141 | +>Add consent notification to the attribute collection page. Notify that the users' telemetry and user identity information will be recorded for account protection purposes. |
| 142 | +
|
| 143 | +## Configure the Azure AD B2C policy |
| 144 | + |
| 145 | +1. Go to the [Azure AD B2C policy](https://github.com/azure-ad-b2c/partner-integrations/tree/master/samples/Dynamics-Fraud-Protection/Policies) in the Policies folder. |
| 146 | + |
| 147 | +2. Follow this [document](https://docs.microsoft.com/azure/active-directory-b2c/custom-policy-get-started?tabs=applications#custom-policy-starter-pack) to download [LocalAccounts starter pack](https://github.com/Azure-Samples/active-directory-b2c-custom-policy-starterpack/tree/master/LocalAccounts) |
| 148 | + |
| 149 | +3. Configure the policy for the Azure AD B2C tenant. |
| 150 | + |
| 151 | +>[!NOTE] |
| 152 | +>Update the policies provided to relate to your specific tenant. |
| 153 | +
|
| 154 | +## Test the user flow |
| 155 | + |
| 156 | +1. Open the Azure AD B2C tenant and under Policies select **Identity Experience Framework**. |
| 157 | + |
| 158 | +2. Select your previously created **SignUpSignIn**. |
| 159 | + |
| 160 | +3. Select **Run user flow** and select the settings: |
| 161 | + |
| 162 | + a. **Application**: select the registered app (sample is JWT) |
| 163 | + |
| 164 | + b. **Reply URL**: select the **redirect URL** |
| 165 | + |
| 166 | + c. Select **Run user flow**. |
| 167 | + |
| 168 | +4. Go through sign-up flow and create an account |
| 169 | + |
| 170 | +5. Microsoft DFP service will be called during the flow, after user attribute is created. If the flow is incomplete, check that the user isn't saved in the directory. |
| 171 | + |
| 172 | +>[!NOTE] |
| 173 | +>Update rules directly in Microsoft DFP Portal if using [Microsoft DFP rule engine](https://docs.microsoft.com/dynamics365/fraud-protection/rules). |
| 174 | +
|
| 175 | +## Next steps |
| 176 | + |
| 177 | +For additional information, review the following articles: |
| 178 | + |
| 179 | +- [Microsoft DFP samples](https://github.com/Microsoft/Dynamics-365-Fraud-Protection-Samples) |
| 180 | + |
| 181 | +- [Custom policies in Azure AD B2C](https://docs.microsoft.com/azure/active-directory-b2c/custom-policy-overview) |
| 182 | + |
| 183 | +- [Get started with custom policies in Azure AD B2C](https://docs.microsoft.com/azure/active-directory-b2c/custom-policy-get-started?tabs=applications) |
0 commit comments