在 Azure AD B2C 中使用 Microsoft 帐户身份提供程序时如何使用公司帐户登录？

Question

I want to build an application where users can log in with their corporate Microsoft / Azure AD account.

For that, I created a Azure AD B2C incl. SignUpSignIn user flow with the "Microsoft Account" identity provider.

Now when I want to log in I get redirected to https://login.live.com/ and can successfully log in with my personal microsoft account. However, if I enter the email address of my corporate account, the error message "This microsoft account is not available" comes up.

The signInAudience of my app registration is set to AzureADandPersonalMicrosoftAccount . So I would expect that also corporate accounts should work?

Answer 1

"Microsoft account" there refers only to personal Microsoft accounts (Outlook/Live/Hotmail accounts).

If you want to only authenticate with one Azure AD tenant, there is guidance for adding that as an identity provider: https://learn.microsoft.com/en-us/azure/active-directory-b2c/identity-provider-azure-ad-single-tenant?pivots=b2c-user-flow .

Multi-tenant Azure AD authentication could be done with the generic OpenID Connect provider I think: https://learn.microsoft.com/en-us/azure/active-directory-b2c/identity-provider-generic-openid-connect?pivots=b2c-user-flow

It can also be achieved through custom policies: https://learn.microsoft.com/en-us/azure/active-directory-b2c/identity-provider-azure-ad-multi-tenant?pivots=b2c-custom-policy .