How to force change password after first login

Question

I have a Azure Active Directory B2C tenant. I also have a small service that creates new users in the B2C tenant from a different system. This way I can synchornize both systems. When a user has been added to B2C and logs in the first time, I want the user to be forced to change the password. But whatever I do, the user can just log in and continue, without changing the password..

To add a user to B2C, I use the Microsoft Graph 1.14 package. I push the user information as JSON to the endpoint https://graph.windows.net/ {tenantId}/users?api-version=1.6

The log in page is an Azure custom page in the user flow policies. There is also a change password policy, if needed.

This I tried:

• When adding the user, I set the password profile. Adding the property "ForceChangePasswordNextLogin" and setting it to true, does not work.

• Someone suggested to add the "ForceChangePasswordNextSignIn" property, but B2C doesn't know this property.

• Tried to fix it in the policy; didn't work.

• Used Google and StackOverflow; not much luck.

This is the user I post to Microsoft Graph:

var user = new GraphUserModel
{
    City = "Amsterdam",
    CustomField= "999999",
    Department = "TestPassword",
    DisplayName = "TestPassword",
    OtherMails = new[] { "myemail@something.nl" },
    PostalCode = "1234 AB",
    StreetAddress = "Hoofdweg 6",
    Surname = "TestPassword",
    TelephoneNumber = "0123456789",
    ChainCode = null,
    MailNickname = "999999",
    UserPrincipalName = "999999@{tenantNameHere}",
    SignInNames = new List<SignInNames>
    {
        new SignInNames
        {
            Type = "userName",
            Value = "999999"
        }
    },
    AccountEnabled = true,
    CreationType = "LocalAccount",
    PasswordProfile = new PasswordProfile
    {
        Password = "SomeRandomPassword"
    },
    PasswordPolicies = "DisablePasswordExpiration"
};

The users are created correctly, but when they log in for the first time, I would like to see a page where they are forced to change the password.

Answer 1

With Sign-up/Sign-in policy I had to implement that manually by flagging users in DB if they have changed the password and then redirecting to password change if they have not changed the password.

I was also not able to find 'out of the box' solution. I found that forceChangePasswordNextLogin works only with Sign-in policy.