Bypass HDR at ADFS for case Azure B2C as SAML Identity Provider

BlackCat 86 Reputation points
2024-02-19T19:46:28.45+00:00

I have setup per this article https://video2.skills-academy.com/en-us/azure/active-directory-b2c/identity-provider-adfs-saml?tabs=windows&pivots=b2c-custom-policy It is working but now I need to Federated with another partner. Added this partner to Claims Provider Trust break the users login experience as users now seeing the prompt to select Identity Providers for login. Is there a way to bypass this HDR at Azure B2C? I think I can do that at ADFS by setting default claim provider trust but still want to see if this can also be done at Azure B2C. Thanks

Active Directory Federation Services
Active Directory Federation Services
An Active Directory technology that provides single-sign-on functionality by securely sharing digital identity and entitlement rights across security and enterprise boundaries.
1,219 questions
Microsoft Entra External ID
Microsoft Entra External ID
A modern identity solution for securing access to customer, citizen and partner-facing apps and services. It is the converged platform of Azure AD External Identities B2B and B2C. Replaces Azure Active Directory External Identities.
2,734 questions
0 comments
Accepted answer
  1. Marilee Turscak-MSFT 35,901 Reputation points Microsoft Employee
    2024-02-21T00:44:02.3533333+00:00

    @BlackCat

    You can't alter the B2C endpoint URIs but you can add the domain_hint query parameter to reroute the users to a specified domain. There are two samples that would be helpful for your use case:

    This sample demonstrates how to implement a sign in journey, where the user is automatically directed to their federated identity provider based off of their email domain. And for users who arrive with an unknown domain, they are redirected to a default identity provider. https://github.com/azure-ad-b2c/samples/blob/master/policies/default-home-realm-discovery

    This sample demonstrates how to create a home realm discovery page. On the sign-in page, the user provides their sign-in email address and clicks continue. B2C checks the domain portion of the sign-in email address. If the domain name is contoso.com the user is redirected to Contoso.com Entra ID to complete the sign-in. Otherwise the user continues the sign-in with username and password. In both cases (B2C local account and Entra ID account), the user does not need to retype the user name. https://github.com/azure-ad-b2c/samples/blob/master/policies/home-realm-discovery-modern

    See also: https://techcommunity.microsoft.com/t5/azure-developer-community-blog/advanced-home-realm-discovery-in-azure-ad-b2c/ba-p/482788

    Let me know if these examples would help with your scenario.

    1 person found this answer helpful.
    0 comments

0 additional answers

Sort by: Most helpful
Most helpful Newest Oldest