What is the recommended approach for generating Azure AD Signin logs with passwordless azure B2C signin custom policy?

Question

I am implementing a passwordless signin experience for local B2C account users with MFA credentials through Azure B2C custom policies. I am using AzureMfaProtocolProvider with a custom attribute stored phone number as an sms MFA option, and OneTimePasswordProtocolProvider with a custom attribute stored email as an email MFA option. When I initiate a login, the first step us username retrieval. The username is used to read the mfa options from AD and then presented to the user as options. Once they select an option, a code is sent and they must successfully validate the code from one of the MFA options to issue a token to the application. This works great, however I noticed that Active Directory does not store and log a "sign in" in the signin logs ( https://learn.microsoft.com/en-us/azure/active-directory/reports-monitoring/concept-all-sign-ins ). Per the document, MFA challenges should generate a signin log but it seems that MFA challenges with these protocol providers (AzureMfaProtocolProvider/ OneTimePasswordProtocolProvider) are not sufficient.

I am concerned that we will miss inherent Active Directory risk tracking without "sign ins" being generated. I am also operating with a business requirement to see those logs generated for auditing purposes.

As a work around, I am adding a psuedo password to user accounts on creation and then faking a login with the "login-NonInteractive" technical profile, which validates the credentials in AD using OIDC. This successfully generates a signin log but it seems hacky. My question is what is the recommended approach to generate a signin log in Azure AD with a passwordless solution?

Answer 1

what is the recommended approach to generate a signin log in Azure AD with a passwordless solution

• For this scenario, you can implement magic link in this web application user can click login button and then user is redirected to identity provider in azure ad b2c.

• Now in custom policy page user can select the magic link option to authenticate and user has to provide the email address and continue azure ad b2c will send a request to magic link web application and then this web api responsible to generating the magic link which we sent to the user mailbox.

For more information in detail, please refer below links:

samples/policies/sign-in-with-magic-link at master · azure-ad-b2c/samples · GitHub

https://github.com/azure-ad-b2c/samples#multi-factor-authentication-enhancements