have to done this please explain me getting the same

@@user-fz2gk9nh8h I have achieved this using blazor wasm and local storage

issue fixed, dont forget to specify "organisations" or "common" instead of tenantId value in appsetting.json

Hi, Thank you for watching! Here are the answers - I hope they will be useful. 1. I would say this is more about the approach rather than specific features. Here is the thing. Single tenant application is created in your Microsoft Entra ID corporate tenant. You can invite guest users and grant them access to this application. You can also enable "self-service sign-up" using user flows so users can sign up and then access your application. However, please remember that B2B is more about corporate Microsoft Entra ID tenants and for B2C scenarios it is recommended to use Azure AD B2C which is separate tenant and service. The most important question is this: "Do I want all customer accounts land in my corporate tenant?". In most cases answer is no. You want to have this isolation so your corporate partner accounts land in Microsoft Entra ID tenant (corporate one) and for customer solutions you use separate tenant - Azure AD B2C. 2. Good question. Partially I answered in m the first point above. This is not about features specifically, it is more about architecture decision. Typically you create separate Azure AD B2C tenant to handle customer (B2C) use cases. You have isolation for accounts, you can customize authentication options (Google, Facebook, others) and you can customize what is included in the tokens issued to applications. You have to differentiate who should be treated as "partner" of your organization (B2B scenario) and to which corporate resource such person should have access to, and who should be treated as a customer (B2C). 3. For users which registered using one time passcode (or one time password) the flow stays exactly the same. Once you registered and you want to access the application once again, you have to provide your email address and then new one-time passcode will be sent to your email. It means that if you are authenticated and your session is still active, you can access the B2B application. If your session is expired, you have to go through the process again (get new code sent to your email). Small fragment from docs: "User sessions expire after 24 hours. After that time, the guest user receives a new passcode when they access the resource.". I hope this clarifies a bit!

Hi, Thank you for watching! Here are the answers - I hope they will be useful. 1. I would say this is more about the approach rather than specific features. Here is the thing. Single tenant application is created in your Microsoft Entra ID corporate tenant. You can invite guest users and grant them access to this application. You can also enable "self-service sign-up" using user flows so users can sign up and then access your application. However, please remember that B2B is more about corporate Microsoft Entra ID tenants and for B2C scenarios it is recommended to use Azure AD B2C which is separate tenant and service. The most important question is this: "Do I want all customer accounts land in my corporate tenant?". In most cases answer is no. You want to have this isolation so your corporate partner accounts land in Microsoft Entra ID tenant (corporate one) and for customer solutions you use separate tenant - Azure AD B2C. 2. Good question. Partially I answered in m the first point above. This is not about features specifically, it is more about architecture decision. Typically you create separate Azure AD B2C tenant to handle customer (B2C) use cases. You have isolation for accounts, you can customize authentication options (Google, Facebook, others) and you can customize what is included in the tokens issued to applications. You have to differentiate who should be treated as "partner" of your organization (B2B scenario) and to which corporate resource such person should have access to, and who should be treated as a customer (B2C). 3. For users which registered using one time passcode (or one time password) the flow stays exactly the same. Once you registered and you want to access the application once again, you have to provide your email address and then new one-time passcode will be sent to your email. It means that if you are authenticated and your session is still active, you can access the B2B application. If your session is expired, you have to go through the process again (get new code sent to your email). Small fragment from docs: "User sessions expire after 24 hours. After that time, the guest user receives a new passcode when they access the resource.". I hope this clarifies a bit!

It depends. Here is the thing. If this 3rd party application is secured by IDP that is federated with Azure AD B2C and user signed in before using account registered in this 3rd party IDP, then user will not have to provide credentials again. However, if user opens 3rd party application and is using separate IDP (not federated with Azure AD B2C and not used before), then user is asked for credentials to successfully authenticate. Please let me know if this answers your question.

Thank you!

Yes, with Azure AD B2C situation is a little bit different. In the custom policies you have the technical profile for your external identity federation. In this technical profile you can map claims from the federated identity provider. Here are examples how you can get claims from the external IDP: <OutputClaim ClaimTypeReferenceId="issuerUserId" PartnerClaimType="oid" /> <OutputClaim ClaimTypeReferenceId="tenantId" PartnerClaimType="tid" /> <OutputClaim ClaimTypeReferenceId="identityProvider" PartnerClaimType="iss" /> Abve you can see that I map "iss" claim from external IDP to "identityProvider" claim that will be returned in the token from the Azure AD B2C. I hope this clarifies a bit!

Thank you!

For SAML service providers, configure the application with the SingleLogoutService location in its SAML metadata document. You can also configure the app registration logoutUrl. Please read here, there are details for both OIDC and SAML: learn.microsoft.com/en-us/azure/active-directory-b2c/session-behavior?pivots=b2c-custom-policy#configure-your-application

If I understood correctly, you would like to create Azure AD B2C users using Microsoft Graph API and C#. Please take a look here: learn.microsoft.com/en-us/graph/api/user-post-users?view=graph-rest-1.0&tabs=csharp#example-1-create-a-user

It looks like this is the problem with cookie access. Do you have "SameSite" set to none for your cookie?

Thank you so much!

I do not see any issue here. Once you do identity verification with additional steps required by your organization's security policies, you can issue VC and confirm workplace.

Thank you for watching and kind words! When it comes to two MFA methods for the same application. Let me ask to clarify. Do you want to give the user option to choose between two available MFA options (like SMS and Authenticator)? So the next time user uses one of them during the authentication process? Please provide more details for your scenario. Having multiple MFA options is 100% possible with the custom policies - I can confirm this. :)

@@TechMindFactory Thanks for the quick response. Ideally, at the time of sign-up, the user would be able to choose their preferred MFA method (Email, SMS, or TOTP) and then use that method from that point forward. If I can offer the choice between all three methods, great, but if only two (SMS and TOTP) are possible, that's OK. Thank you!

Thank you!