You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/active-directory-b2c/phone-factor-technical-profile.md
+28-28Lines changed: 28 additions & 28 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -9,7 +9,7 @@ manager: celestedg
9
9
ms.service: active-directory
10
10
ms.workload: identity
11
11
ms.topic: reference
12
-
ms.date: 03/26/2020
12
+
ms.date: 03/31/2020
13
13
ms.author: mimart
14
14
ms.subservice: B2C
15
15
---
@@ -20,12 +20,11 @@ ms.subservice: B2C
20
20
21
21
Azure Active Directory B2C (Azure AD B2C) provides support for enrolling and verifying phone numbers. This technical profile:
22
22
23
-
- Provides a user interface to interact with the user.
24
-
- Uses content definition to control the look and feel.
25
-
- Supports both phone calls and text messages to validate the phone number.
23
+
- Provides a user interface to interact with the user to verify, or enroll a phone number.
24
+
- Supports phone calls and text messages to validate the phone number.
26
25
- Supports multiple phone numbers. The user can select one of the phone numbers to verify.
27
-
-If a phone number is provided, the phone factor user interface asks the user to verify the phone number. If not provided, it asks the user to enroll a new phone number.
28
-
-Returns a claim indicating whether the user provided a new phone number. You can use this claim to decide whether the phone number should be persisted to the Azure AD user profile.
26
+
-Returns a claim indicating whether the user provided a new phone number. You can use this claim to decide whether the phone number should be persisted to the Azure AD B2C user profile.
27
+
-Uses a [content definition](contentdefinitions.md)to control the look and feel.
29
28
30
29
## Protocol
31
30
@@ -41,19 +40,25 @@ The following example shows a phone factor technical profile for enrollment and
41
40
</TechnicalProfile>
42
41
```
43
42
44
-
## Input claims
43
+
## Input claims transformations
45
44
46
-
The InputClaims element must contain following claims. You can also map the name of your claim to the name defined in the phone factor technical profile.
45
+
The InputClaimsTransformations element may contain a collection of input claims transformations that are used to modify the input claims, or generate new ones. The following input claims transformation generates a `UserId`claim that is used later in the input claims collection.
47
46
48
-
```XML
49
-
<InputClaims>
50
-
<!--A unique identifier of the user. The partner claim type must be set to `UserId`. -->
<!--A claim that contains the phone number. If the claim is empty, Azure AD B2C asks the user to enroll a new phone number. Otherwise, it asks the user to verify the phone number. -->
The InputClaims element must contain the following claims. You can also map the name of your claim to the name defined in the phone factor technical profile.
56
+
57
+
| Data type| Required | Description |
58
+
| --------- | -------- | ----------- |
59
+
| string| Yes | A unique identifier for the user. The claim name, or PartnerClaimType must be set to `UserId`. This claim should not contain personal identifiable information.|
60
+
| string| Yes | List of claim types. Each claim contains one phone number. If any of the input claims do not contain a phone number, the user will be asked to enroll and verify a new phone number. The validated phone number is returned as an output claim. If one of the input claims contain a phone number, the user is asked to verify it. If multiple input claims contain a phone number, the user is asked to choose and verify one of the phone numbers. |
61
+
57
62
The following example demonstrates using multiple phone numbers. For more information, see [sample policy](https://github.com/azure-ad-b2c/samples/tree/master/policies/mfa-add-secondarymfa).
58
63
59
64
```XML
@@ -64,22 +69,16 @@ The following example demonstrates using multiple phone numbers. For more inform
64
69
</InputClaims>
65
70
```
66
71
67
-
The InputClaimsTransformations element may contain a collection of InputClaimsTransformation elements that are used to modify the input claims or generate new ones before presenting them to the phone factor page.
68
-
69
72
## Output claims
70
73
71
74
The OutputClaims element contains a list of claims returned by the phone factor technical profile.
72
75
73
-
```xml
74
-
<OutputClaims>
75
-
<!-- The verified phone number. The partner claim type must be set to `Verified.OfficePhone`. -->
| boolean | Yes | Indicates whether the new phone number has been entered by the user. The claim name, or PartnerClaimType must be set to `newPhoneNumberEntered`|
79
+
| string| Yes | The verified phone number. The claim name, or PartnerClaimType must be set to `Verified.OfficePhone`.|
81
80
82
-
The OutputClaimsTransformations element may contain a collection of OutputClaimsTransformation elements that are used to modify the output claims or generate new ones.
81
+
The OutputClaimsTransformations element may contain a collection of OutputClaimsTransformation elements that are used to modify the output claims, or generate new ones.
83
82
84
83
## Cryptographic keys
85
84
@@ -91,7 +90,9 @@ The **CryptographicKeys** element is not used.
91
90
| Attribute | Required | Description |
92
91
| --------- | -------- | ----------- |
93
92
| ContentDefinitionReferenceId | Yes | The identifier of the [content definition](contentdefinitions.md) associated with this technical profile. |
94
-
| ManualPhoneNumberEntryAllowed| No | Specify whether or not a user is allowed to manually enter a phone number. Possible values: `true` or `false` (default).|
93
+
| ManualPhoneNumberEntryAllowed| No | Specify whether or not a user is allowed to manually enter a phone number. Possible values: `true`, or `false` (default).|
94
+
| setting.authenticationMode | No | The method to validate the phone number. Possible values: `sms`, `phone`, or `mixed` (default).|
95
+
| setting.autodial| No| Specify whether the technical profile should auto dial or auto send an SMS. Possible values: `true`, or `false` (default). Auto dial requires the `setting.authenticationMode` metadata be set to `sms`, or `phone`. The input claims collection must have a single phone number. |
95
96
96
97
### UI elements
97
98
@@ -100,4 +101,3 @@ The phone factor authentication page user interface elements can be [localized](
100
101
## Next steps
101
102
102
103
- Check the [social and local accounts with MFA](https://github.com/Azure-Samples/active-directory-b2c-custom-policy-starterpack/tree/master/SocialAndLocalAccountsWithMfa) starter pack.
This article shows you how to configure Azure App Service to use Azure Active Directory (Azure AD) as an authentication provider.
14
+
This article shows you how to configure Azure App Service or Azure Functions to use Azure Active Directory (Azure AD) as an authentication provider.
15
+
16
+
> [!NOTE]
17
+
> At this time, [Azure Active Directory v2.0](../active-directory/develop/v2-overview.md) (including [MSAL](../active-directory/develop/msal-overview.md)) is not supported for Azure App Service and Azure Functions. Please check back for updates.
18
+
>
15
19
16
20
Follow these best practices when setting up your app and authentication:
17
21
@@ -67,7 +71,8 @@ Perform the following steps:
67
71
1. In **Redirect URI**, select **Web** and type `<app-url>/.auth/login/aad/callback`. For example, `https://contoso.azurewebsites.net/.auth/login/aad/callback`.
68
72
1. Select **Create**.
69
73
1. After the app registration is created, copy the **Application (client) ID** and the **Directory (tenant) ID** for later.
70
-
1. Select **Branding**. In **Home page URL**, enter the URL of your App Service app and select **Save**.
74
+
1. Select **Authentication**. Under **Implicit grant**, enable **ID tokens** to allow OpenID Connect user sign-ins from App Service.
75
+
1. (Optional) Select **Branding**. In **Home page URL**, enter the URL of your App Service app and select **Save**.
71
76
1. Select **Expose an API** > **Set**. Paste in the URL of your App Service app and select **Save**.
72
77
73
78
> [!NOTE]
@@ -91,7 +96,7 @@ Perform the following steps:
91
96
|Field|Description|
92
97
|-|-|
93
98
|Client ID| Use the **Application (client) ID** of the app registration. |
94
-
|Issuer ID| Use `https://login.microsoftonline.com/<tenant-id>`, and replace *\<tenant-id>* with the **Directory (tenant) ID** of the app registration. |
99
+
|Issuer Url| Use `https://login.microsoftonline.com/<tenant-id>`, and replace *\<tenant-id>* with the **Directory (tenant) ID** of the app registration. This value is used to redirect users to the correct Azure AD tenant, as well as to download the appropriate metadata to determine the appropriate token signing keys and token issuer claim value for example. |
95
100
|Client Secret (Optional)| Use the client secret you generated in the app registration.|
96
101
|Allowed Token Audiences| If this is a cloud or server app and you want to allow authentication tokens from a web app, add the **Application ID URI** of the web app here. The configured **Client ID** is *always* implicitly considered to be an allowed audience. |
97
102
@@ -101,21 +106,21 @@ You're now ready to use Azure Active Directory for authentication in your App Se
101
106
102
107
## Configure a native client application
103
108
104
-
You can register native clients to allow authentication using a client library such as the **Active Directory Authentication Library**.
109
+
You can register native clients to allow authentication to Web API's hosted in your app using a client library such as the **Active Directory Authentication Library**.
105
110
106
111
1. In the [Azure portal], select **Active Directory** > **App registrations** > **New registration**.
107
112
1. In the **Register an application** page, enter a **Name** for your app registration.
108
113
1. In **Redirect URI**, select **Public client (mobile & desktop)** and type the URL `<app-url>/.auth/login/aad/callback`. For example, `https://contoso.azurewebsites.net/.auth/login/aad/callback`.
109
114
110
115
> [!NOTE]
111
-
> For a Windows application, use the [package SID](../app-service-mobile/app-service-mobile-dotnet-how-to-use-client-library.md#package-sid) as the URI instead.
116
+
> For a Microsoft Store application, use the [package SID](../app-service-mobile/app-service-mobile-dotnet-how-to-use-client-library.md#package-sid) as the URI instead.
112
117
1. Select **Create**.
113
118
1. After the app registration is created, copy the value of **Application (client) ID**.
1. Select the app registration you created earlier for your App Service app. If you don't see the app registration, make sure that you've added the **user_impersonation** scope in [Create an app registration in Azure AD for your App Service app](#register).
116
121
1. Select **user_impersonation**, and then select **Add permissions**.
117
122
118
-
You have now configured a native client application that can access your App Service app.
123
+
You have now configured a native client application that can access your App Service app on behalf of a user.
This article shows how to configure Azure App Service to use Facebook as an authentication provider.
17
+
This article shows how to configure Azure App Service or Azure Functions to use Facebook as an authentication provider.
17
18
18
19
To complete the procedure in this article, you need a Facebook account that has a verified email address and a mobile phone number. To create a new Facebook account, go to [facebook.com].
This topic shows you how to configure Azure App Service to use Google as an authentication provider.
16
+
This topic shows you how to configure Azure App Service or Azure Functions to use Google as an authentication provider.
16
17
17
18
To complete the procedure in this topic, you must have a Google account that has a verified email address. To create a new Google account, go to [accounts.google.com](https://go.microsoft.com/fwlink/p/?LinkId=268302).
This topic shows you how to configure Azure App Service to use AAD to support personal Microsoft account logins.
17
+
This topic shows you how to configure Azure App Service or Azure Functions to use AAD to support personal Microsoft account logins.
17
18
18
19
> [!NOTE]
19
20
> Both personal Microsoft accounts and organizational accounts use the AAD identity provider. At this time, is not possible to configure this identity provider to support both types of log-ins.
This article shows how to configure Azure App Service to use Twitter as an authentication provider.
17
+
This article shows how to configure Azure App Service or Azure Functions to use Twitter as an authentication provider.
17
18
18
19
To complete the procedure in this article, you need a Twitter account that has a verified email address and phone number. To create a new Twitter account, go to [twitter.com].
0 commit comments