在 Azure AD B2C 中，是否可以使用无密码登录策略，用户输入电子邮件并将 OTP 发送到关联的手机号码？

Question

1. In Azure AD B2C, is it possible to have a password less sign in policy where user enters email and OTP is sent to associated mobile number?
2. Can we associate multiple phone numbers to a consumer account without custom/extension attribute?

Regarding point 1, even if we manage to create it, should we use this policy. Is it a good practice?

Answer 1

1. Yes, you'd have to create it via custom policy.
2. Yes, via custom policy you'd have to create an additional endpoint. This endpoints points to a db with a list of phone numbers and returns true if it's in that list. As for best practice, it's dependent on the user requirements.

It's a bit tricky to develop custom policies.

Here's a good starting point: https://docs.microsoft.com/en-us/azure/active-directory-b2c/solution-articles