B2C and external tenants

B2C tenants

Module supports loggin in to B2C tenants.
Sample below shows how to get AAD token usable to authenticate with applications integrated with B2C tenant

$myB2CTenant = 'myb2ctenant.onmicrosoft.com'
$myB2CClientId = 'd01734f1-2a3f-452e-ad42-8ffe7ae300bf'
$myB2CClientRedirectUri = 'http://localhost:44351/'
$myB2CLoginApi = " https://myb2ctenant.b2clogin.com"
$myB2CAPI = "$myB2CTenant/13e25c85-a23a-4858-b988-4f171265a92d"

New-AadAuthenticationFactory `
    -ClientId $myB2CClientId `
    -TenantId $myB2CTenant `
    -AuthMode Interactive `
    -B2CPolicy 'B2C_1_siso' `
    -LoginApi $myB2CLoginApi `
    -RedirectUri $myB2CClientRedirectUri
Get-AadToken -Scopes "$myB2CAPI/.default" | Test-AadToken -Verbose

External tenants

Module also supports external tenants. Microsoft Entra External ID covers many customer or external-user sign-in scenarios, but its configuration model differs from Azure AD B2C, so the two should be treated as related but distinct offerings. Sample below shows how to get AAD token usable to authenticate with applications integrated with external tenant

$myClientId = '5a3a8e2a-2d0f-49a6-9e34-5b61201f94a4'
$myTenantId = 'myCIAMtenant.onmicrosoft.com'
$myResource = 'api://3658ff2d-6ef7-4d54-b245-db9f0ae26ee1/.default'
New-AadAuthenticationFactory `
    -name ciam-test `
    -TenantId $myTenantId `
    -AuthMode Interactive `
    -LoginApi 'https://myCIAMtenant.ciamlogin.com' `
    -ClientId $myClientId

Get-AadToken -Scopes $myResource | Test-AadToken -PayloadOnly

Notes:

• When configuring resource app's registration, be sure to configure scope(s) and make clientID of your client app an authorized client application - otherwise you may observe errors with loop of permission consent requests
• External tenant configurations do not use Azure AD B2C policies in the same way as classic B2C samples, so configure the sign-in experience according to the tenant type you are using
• Default client ID used by the module (1950a258-227b-4e31-a9cf-717495945fc2) is not supported in external tenants, so you need to specify your own client ID