►
From YouTube: Protect your brand with Azure Active Directory B2C and Zero Trust Security – November 2021
Description
This month’s in-depth topic: Protect your brand with Azure Active Directory B2C and Zero Trust Security. Overview of B2C protection capabilities in Azure and Dynamics 365. Azure AD External Identities – P1 and P2. Enabling P2, collaboration with external partners and engaging with customers with Azure AD B2C. Setting up User flows and custom policies. Reviewing Microsoft CIAM, Azure Front Door, Conditional Access + Identity Protection for Azure AD B2C and Dynamics 365 Fraud Protection Account Protection. This session was delivered by Christer Ljung – Principal Program Manager, Microsoft Identity Engineering. Recorded November 18, 2021. Q&A in chat and at end of call.
Stay connected:
• Twitter https://twitter.com/microsoft365dev and @azuread
• YouTube https://aka.ms/M365DevYouTube (Developer channel) and https://aka.ms/m365pnp/videos (Community channel)
• Blogs https://aka.ms/m365pnp/community/blog
• Recurrent Invite https://aka.ms/IDDevCommunityCalendar
A
So,
let's
get
started,
my
name
is
christy
jung.
I
work
as
a
program
manager,
principal
program
manager
in
microsoft,
ident
engineering
in
an
area
we
call
cxp
if
you're
wondering
where
the
dialect
comes
from,
I'm
from
sweden
in
northern
europe,
scandinavia
and
I
work
quite
a
lot
with
customers
in
the
emea
region,
but
it's
a
worldwide
team.
So
I
work
with
customers
all
over
the
world
and
the
today's
topic
is
about
azure
id
b2c
with
the
title
protect
your
brand
with
azure
active
directory,
b2c
and
zerotrust
security.
A
I'm
going
to
talk
and
I'm
to
do
two
demos-
and
I
mean
you
might
ask
questions.
You
might
write
them
in
a
chat
window
I'll
try
to
manage
as
much
as
possible
and
follow
up.
If
you
have
a
question
and
you
feel
comfortable
opening
mic,
let's
do
that,
but
let's
also
try
to
see
that
we
can
get
through
the
content
here.
I'll
try
to
make
some
room
at
the
end
for
for
a
q
a
also,
but
let's
get
started
yeah.
They
protect
your
brand.
A
A
A
A
What
does
happen
also
is
that
you,
as
a
user,
when
you
do
deploy
the
first
tenant,
you
become
the
initial
global
admin,
the
root
user,
etc
and
you're
the
only
one
who
can
switch
directory
and
start
using
this
b2c
tenant,
if
you
add
owners
or
contributors
etc
to
this
resource
group,
they
don't
really
get
access
into
the
tenant.
They
can't
switch
a
directory
and
start
sort
of
doing
stuff
because
they
don't
have
access
to
the
tenant.
A
That
is
why
the
user
interface
and
the
portal
looks
like
this.
When
you
create
a
b2c
tenant,
you
can
give
it
a
nice
name,
and
the
more
important
thing
is
what's
going
to
be
called
something
something
like
contoso.org
on
microsoft.com,
and
this
needs
to
be
unique
because
it's
the
tenant
name.
You
also
pick
a
country
which
we
map
to
region
where
azure
data
centers,
where
b2c
is
actually
available
so
that
it
lands
in
the
u.s.
A
If
you,
if
that
is
where
your
business
is
or
it
lands
in
europe
or
australia,
etc,
then
you
see
down
here
that
you
need
to
link
it
to
a
b2c
resource
group
in
a
subscription.
So
any
of
those
available
in
the
user
that
you're
currently
signed
in
with
in
the
portal
will
be
available
to
you,
the
resource
group.
You
can.
You
can
move
that
later,
but
I
mean
that's
where
the
the
reason
why
you
have
to
pick
one:
it's
not
like
you're
provisioning,
the
b2c
tenant
into
the
subscription.
A
A
So
you
actually
can
invite
partners
you
collaborate
with
with
these
applications,
not
just
from
azure
id
tenants
but
from
social
providers.
Also,
not
everyone
has
an
azure
id
tenant
and
it's
a
bit
silly
to
go
and
ask
them
to
create
one
just
because
you
want
to
share
a
few
documents
with
them,
even
though
they
might
have
benefits
with
azure
id
in
general
ashrae.
Also
many
companies,
you
synchronize
the
identities
from
windows,
active
directory
that
you
have.
B
A
A
On
the
left
hand,
side
going
counterclockwise
the
black
dark,
gray
and
light
gray
rectangles
here
cm
they
represent
the
other
accounts
I
mean
b2c
can
have
local
accounts,
but
you
can
also
federate
with
identity
providers
being
your
company's
directory
being
countries,
citizen,
digital
directories,
etc.
To
enable
you
to
federate
and
and
sign
in
or
perhaps
do
other
stuff
with
identity
providers
like
that
bitch's
sort
of
stronghold
has
always
been
to
that.
A
In
the
lower
left,
we
have
the
new
stuff,
the
cool
stuff
like
passwordless,
etc,
authenticator.
Even
for
b2c,
I
usually
say
that
it
comes
sort
of
two
steps
behind
ashrae
for
the
enterprise
because
it
has
to
do
with
user
maturity.
How
mature
is
the
market
out
there
for
using
all
this
new
technology
in
corporate
I.t?
A
So
this
gradually
sort
of
makes
its
way
into
b2c
and
the
more
the
more
accepted
and
ready
consumers
are
for
this,
the
more
it
would
be
introduced,
and
I
think,
we're
pretty
soon
at
a
breaking
point
where
at
least
two-factor
authentication
is
something
that
I've
seen
in
conversations.
I
have
where
it's
being
used
quite
a
lot
with
b2c
deployments.
A
Bill
asked
a
question:
if
b2c
has
the
ability
to
use
an
account
that
doesn't
have
an
email,
absolutely
I'll
show
you
that
in
one
of
the
demos,
perhaps
not
the
phone
number,
but
I
think
you
will
see
that
you
can.
You
can
add
other
things,
good
question.
The
other
questions
are
a
bit
longer
I'll.
Try
to
help
you
with
that.
But
if
we
look
at
the
b2c
architecture,
how
does
it
compare
to
azure
ad
in
general
and
what?
How
does
it
differ?
A
A
The
red
layer
is
also
since
it's
storage,
it's
the
persistence
layer.
So
if
you
choose
united
states
when
you
created
it,
that
means
that
the
red
lego
piece
will
be
deployed
in
azure
data
centers
in
the
u.s.
If
you
choose
a
country
in
europe,
it
means
that
it
will
be
deployed.
The
red,
lego
layer
will
be
deployed
into
data
centers
in
europe
same
for
asia
and
australia.
A
A
A
That
is
sort
of
what
makes
b2c
unique,
because
the
red
layer
is
is
pretty
similar
to
an
ashrae
enterprise
tenant,
but
the
blue
layer
is
really
what
makes
it
unique,
because
that
is
the
policy
engine.
It
holds
the
the
policy
configuration
and
it
knows
the
protocols
and
the
way
we
interact
with
them
this
one.
You
can
think
of
it
that
it's
been
executed
globally,
meaning
that
even
it
could
be
executing
in
a
data
center,
where
you
don't
really
have
the
data
stored
just
to
sort
of
offload
and
to
your
nearest
point
of
presence.
A
A
I
need
to
bootstrap
that
so
when
I
sign
into
the
portal
I'm
actually
signing
in
on
the
tenant
level
on
the
red
level,
but
my
application
and
the
end
users,
when
they
sign
in
they
should
not
do
the
same,
because
it's
only
I.t
admins.
That
really
should
log
into
the
red
layer.
Users
will
hit
the
blue
policy
engine
and
we'll
do
that
via
an
endpoint
that
has
a
little
bit
of
a
different
name.
A
It's
called
whatever
your
tenant
name
was
and
b2clogin.com,
and
you
will
talk
to
the
blue
lego
piece
in
either
open
id
or
author
saml.
That's
what
it
speaks
when
the
policy
engine
is
executing,
I
mean
it
do
talk
to
the
red
layer
to
sort
of
read
and
write
and
load
the
user
profile,
etc.
So
they
work
together.
A
A
If
you
look
at
or
if
you
do,
an
entrance
search,
the
b2c
support,
client
credentials
and
you
see
no,
it
doesn't
what
it
means,
then.
Is
you
can't
invoke
the
b2c
login
endpoint
hit
a
policy
and
ask
for
client
credentials,
but
you
can
do
it
on
the
red
layer,
because
that's
how
you
do
it
and
that's
supported
speaking
of
client
credentials.
We
are
bringing
that
forward.
You
will
see
that
in
public
preview
soon
the
policy
engine,
then
what
it
does
it
executes.
A
A
A
Yes,
we
do
read
the
user
profile
etc
with
the
the
underlying
directory,
and
you
can
also
integrate
with
things
like
dynamics,
365
fraud,
protection
that
I'll
talk
a
little
bit
but
more
later,
this
this
way
of
using
the
policy
comes
in
two
flavors
they're
called
user
flows
and
custom
policies.
You
can
think
of
them
as
a
basic
and
advanced
because
the
user
flows.
There
are
things
that
you
configure
in
the
portal.
A
You
don't
need
to
open
a
text
editor
anything,
but
it's
really
just
policies
that
we
at
microsoft
have
created
and
we
give
you
options
sort
of
to
configure
them
in
the
easy
way
in
the
portal,
the
custom
policies
or
identity
experience
framework,
as
the
official
name
is.
That
is
where
you
say
what
I'm
about
to
do
is
requires
me
to
configure
it
myself,
so
I
will
get
a
set
of
files
there
in
xml,
where
I
do
the
config
configuration
myself
and
I
upload
them
and
we
execute
them.
A
A
We
get
questions
like
can
b2c,
do
this
and
can
be
to
see.
Do
that
etcetera?
If
you
step
out
and
and
look
at
sort
of,
what
is
a
solution
that
you
deploy?
Everything
is
not
in
b2c.
The
total
solution
will
probably
use
some
other
functions
and
features
that
you
have
in
azure
in
order
to
create
the
total
solution
for
you.
One
such
thing
is
probably
azure
monitor
to
set
up
the
monitoring
of
your
tenant.
A
That
works
very
much
like
it
does
for
ashrae
in
the
enterprise,
because
the
red
lego
piece
at
the
bottom
works
the
same
way.
So
you
can
connect
it
and
you
can
get
the
audit
logs
and
sign-in
logs
out
to
azure
monitor
so
an
answer
there
would
be.
Do
you
support
monitoring
and
audit?
Yes,
we
do.
We
have
audit
logs
and
sign-in
logs
inside
b2c,
but
you
probably
are
going
to
use
azure
monitor
to
process
them.
A
A
A
But
one
thing
I
see
here
is
the
pricing
tier.
It
says
p1
premium
p1,
so
what
I
can
do
is
I
can
just
flip
this
and
press
save
and
if
I
have
a,
as
I
said,
a
tenant
that
I
never
reach
50k
monthly,
active
users,
it's
not
going
to
cost
me
anything
I'll!
Just
do
that
and
press
save,
and
it's
going
to
save
that
for
me
and
from
then
on
it's
a
p2
come
on.
I
did
try
to
close
you
it's
a
p2
and
when
that
action
kicks
in
this
will
be
refreshed.
A
A
You
see
here
that
I
got
a
little
bit
of
styling.
I
got
the
shop
from
the
moon
and
a
little
special
logo
type,
there's
nothing
special
with
b2c
for
that
that
comes
from
the
red
lego
piece
and
how
you
can
do
directory
styling,
so
I'll
go
into
azure
b2c,
and
here
you
see
a
few
options.
Some
of
them
are
shared
with
the
azure
id
tenant
like
app
registration,
users,
etc.
A
It's
because
it
would
be
not
a
good
way
working
if
we
didn't
replicate
them
here,
you
needed
to
go
back
and
forth
or
have
multiple
tabs,
etc.
So
some
are
sort
of
duplicated
and
it
doesn't
really
matter
if
I
go
in
and
do
user
management
in
the
azure
id
blade,
because
I
mean
it's
it's
the
same,
it
would
be
the
same
users,
the
same
panel
that
shows
up
and
as
a
matter
of
fact,
for
some
operations
like
working
with
groups,
there's
no
mentioning
of
groups
here.
A
There
is
no
cost
alert.
To
avoid
a
surprise,
because
I
mean
it
happens
when
it
happens
all
of
a
sudden-
and
this
is
sort
of
also
the
accounting
for
this
is
it's
not.
I
mean
it
isn't
real
time,
but
it
when
people
sign
in
you
accumulate
that
and
then
you
just
see
how
many
unique
users
you
have
at
the
end
of
it.
A
A
So
let's
do
that
now.
I
can
do
that
later.
So,
let's
do
let's
run
a
user
flow,
and
you
saw
perhaps
that
I
had
created
here,
I'm
going
back
to
identity
providers.
I
had
set
up
a
few
here
and
I've
set
up
a
federation
with
facebook,
google.
I
have
local
accounts
and
I
have
configured
an
azure
id
tenant,
not
a
b2c,
but
a
corporate
tenant.
A
A
If
I
go
to
identity
providers,
I
can
click
to
say
which
ones
should
be
valid
in
this
policy
when
I
try
to
sign
in
and
I've
configured
to
do,
email
sign
up,
google
and
the
azure
id
federation
with
this,
I've
also
done
a
little
bit
of
extra
configuration.
I
haven't
reverted
to
the
custom
policies,
yet
I'm
using
the
plain
one.
I've
said
that
no
javascript,
if
you
don't
use
javascript
disable
it
and
b2c,
will
make
sure
that
no
javascript
runs
except
e
to
c
zone.
A
A
So
this
is
the
sign-in
page.
You
see
that
it
takes
the
b2c
tenant.
Styling
puts
the
claim
in
here
I
selected
my
azure
id
tenant.
Google,
and
you
see
the
the
the
footer
here.
That
is,
that
is
there,
I'm
gonna
use
google
here
and
go
to
the
federation
with
a
google
account
I'll
pick
a
demo
account.
I
have
b2c
actually
redirected
to
to
gm
google
here
I'll
use,
my
gmail
account
it's
configured.
A
A
A
A
A
So
I
signed
in-
and
I
get
a
token
from
b2c-
the
test
app
is
redirecting
to
jot.ms
just
to
sort
of
display.
The
the
token
I
see
that
is
being
issued
by
my
tenant,
b2c,
login
and
the
tenant
id.
This
is
where
it
differs
from
azure
id
for
the
enterprise,
because
it
will
say
something
like
sts
windows
net,
and
this
is
also
why
I
can't
send
this
token
to
teams
or
outlook,
because
it's
going
to
say
no,
it
doesn't
come
from
me.
A
A
One
interesting
thing
here
is
also
to
note
this:
there's
a
collection
called
identities
and
this
collection
governs.
How
can
I
sign
in
how
can
a
user
authenticate
and
match
itself
onto
this
user
profile,
and
in
this
case
you
see,
we
have
the
standard.
One
is
sort
of
just
a
user
principle
name
here
that
you
really
don't
use
b2c,
just
fabricates
that
one,
but
you
see
that
the
first
element
is
says
that
this
is
a
federated
account.
A
It's
got
a
little
details
here
about
myself
and
you'll,
see
in
the
identity
section
that
this
time
it
looks
a
little
bit
different.
It's
got
two
entries
use
the
principal
name
and
that
we're
not
using,
and
then
it
says
you
can
log
in
via
an
email
address.
But
what?
If
we
want
to
change
this-
and
this
is
a
common
question-
can
I
sort
of
merge
accounts?
A
A
A
A
I've
added
a
little
extra
buttons
here,
just
to
be
able
to
illustrate
what
is
really
going
on
on
the
client
side
when
you
do
authenticate,
so
I'm
going
to
use
the
same
authentication
mechanism
like
this
and
sign
in
and
list
the
token
cache,
be
it
a
smartphone,
app
or
or
a
browser
or
or
a
desktop
app
when
it
interacts
with
b2c,
I
mean
it,
it
receives
tokens
and
you
have
a
local
token
cache
and
they
have
a
lifetime.
In
this
case
I've
tuned
it
down
quite
a
bit.
A
A
If
I
do
the
same
thing
for
the
right
api,
it's
going
to
say:
do
you
have
in
your
local
cache
an
access
token
for
write?
I
don't
so
I'm
going
to
interact
with
b2c
as
an
identity
provider
to
get
it.
You
see.
We
did
something
called
token
here.
We're
calling
we're
calling
b2c
to
say,
hey,
and
you
give
me
an
access
token
for
this
api
api
right
and
by
the
way,
I'm
passing
my
sso
cookie
here.
So
this
is
me,
I'm
authenticated.
A
A
A
Well,
when
a
user
signs
in
you
can
put
something
like
azure
front
door
in
front
of
it,
azure
front
door?
Is
a
wav
application
firewall.
It
also
is.
It
enables
custom
domains
for
you
and
then
you
can
use
identity
protection,
but
that
you
can
only
use
in
in
the
p2
feature.
That's
why
I
think
you
should
bump
it
up
to
p2
for
all
tenants.
A
You
have
that
are
below
50k,
because
it's
a
it's
more
or
less
a
no-brainer
and
it
could
be
real-time
aggregations
of
who
you
are
when
you
try
to
sign
in
where
you
come
from
what
ip
address
etc.
Are
you
you
come
from
a
malicious
network
that
we
have
detected
that
there's
something
funny
going
on
there
or
when
you
sign
in?
Does
your
signing
criteria
match
something
that
microsoft
have
identified,
that
this
is
leaked
credentials,
etc
or
another
threat?
A
A
We
have
the
conditional
access
part
that
helps
you
to
evaluate
this
and
take
actions
like
what
should
you
do
just
allow
it
require
mfa,
etc
and
take
other
actions
beside
that.
You
can
bypass
this
and
everything
is
good,
but
it
might
be
that
the
the
activity
that
is
going
on
is
still
borderline
legitimate,
like
you
have
a
campaign,
and
you
want
to
make
sure
that
no
one
is
signing
up
a
thousand
times
just
to
get
a
good
discount
or
win
a
contest
or
whatever.
A
That
is
where
dynamics
365
fraud
protection
comes
into
play
because
it
can
help
you
to
do
extra
extra
checks
to
see.
Is
this
sign-in
really
legitimate
according
to
your
sort
of
rules
and
purposes,
and
then,
of
course,
you
can
have
azure
monitoring,
so
you
can
see.
What's
going
on
and
all
of
a
sudden,
you
have
three
million
logins
from
some
place
in
the
world
and
you
can
see
that
oh
what's
happening
here,
etc.
A
The
things
that
are
there
for
b2c
are
really
the
custom
domain
and
the
wav
the
other
things.
It's
not
so
much
for
b2c,
because
ssl
off
loading
application,
accelerating
b2c
in
itself
is
a
is
a
cloud
service.
So
you
don't
need
that.
But
many
customers
do
want
a
custom
domain
which
you
can
get
with
azure
front
door.
So
you
don't
have
my
tenant
b2clogin.com.
You
want
to
have
contoso.com,
so
it
looks
very
much
like
your
application.
A
That's
achieved
both
via
front
door.
The
other
thing
is,
you
can
start
using
the
wav
in
front
door
and
get
a
higher
protection
against
ddos,
etc,
and
and
configure
it
with
all
the
the
good
stuff
that
is
in
azure
front
or
to
protect
the
logging
part
of
your
application
more.
You
could,
of
course,
sort
of
route
the
traffic
to
your
application,
what
it's
doing
after
sign
in
through
the
same
graph,
but
since
the
the
interaction
to
the
blue
lego
piece
goes
via
the
front
door.
A
A
So
it's
going
to
take
care
of
it.
Do
all
this
sort
of
wave
checks
and
bot
origins,
header
body,
query
parameters,
ip
addresses,
whatever
you
configure
it
to
do,
and
then
I'm
going
to
wrote
it
route
it
to
the
front
turf
functionality
that
works
with
b2c,
and
this
is
b
to
c
in
front
or
node
knows
each
other.
So
b2c
sees
that
this
comes
from
front
door,
etc
and
make
sure
to
to
acknowledge
the
custom
domain
in
everything
it's
doing
in
in
the
other
replies,
etc.
A
A
What
you
do
with
identity
protection
and
conditional
access
is
basically
sort
of
deciding,
given
that
we
score
this
sign
in
for
you.
What
should
you
do?
Should
you
allow
it,
or
should
you
block
it?
Should
you
take
actions
like
require
mfa
or
force
password
reset?
You
need,
you
need
to
take
action
somewhere
or
if
you
use
conditional
access
you
don't
have
to.
A
But
if
you
have
the
p2
feature,
you
can
create
user
journeys
and
policies
that
take
advantage
of
them,
and
it
looks
like
this
that
assigning
comes
with
different
attributes
like
what
type
of
sign-in
are
using
using
google
et
cetera,
using
a
business
account.
Where
do
you
come
from
physically?
What
network?
What
type
of
application
are
you
using
are
using
a
tor
browser,
etc?
A
Sort
of
to
also
to
illustrate
what
a
normal
customer
journey
includes
and
not
just
from
b2c,
but
in
any
case
where
you
sign
up,
I
mean
account
creation,
you
face
the
risk
of
fake
accounts
and
synthetic
identities.
When
you
do
log
in
it
could
be
compromised,
etc.
It
could
be
phishing
brute
force
when
you're
trying
to
do
a
purchase.
You
have
the
fraud
of
different
categories
here,
etc,
and
all
this
needs
to
sort
of
be
handled
one
way
or
the
other
b2c.
A
A
If
we
go
back
to
the
b2c
portal-
and
we
back
out
of
here
like
this
fresh
again
yeah
like
this-
what
I
what
happens
when
I
create
a
user
flow,
is
I
get
a
few
options
here?
What
should
it
do
sign
up
sign
in
I'll
pick
that
one,
then
you
get
an
selection
down
here.
That
says
version
could
be
a
little
more
helpful
in
saying
what
it
really
means.
But
if
you
pick
the
recommended,
you
can
create
a
sign-in
journey
that
includes
conditional
access
hey,
so
it
doesn't
really
matter,
but
let's
call
it
like
that.
A
A
I
could
say
that
mfa
isn't
forced
to
via
conditional
access,
I'm
not
going
to
turn
it
off
by
completely
I'm
not
going
to
turn
it
on
to
say
everyone
has
to
do
it,
I'm
going
to
say
conditional,
meaning
that
if
the
score
indicates
we
should
do
it.
Let's
do
it,
I'm
also
going
to
click
this
one,
and
that's
you
only
get
in
the
recommended
to
say
I
do
want
conditional
access
to
be
part
of
this
policy
so
that
I
get
the
benefit
from
it.
A
I
just
picked
switzerland
because
there's
a
data
center
there.
So
sorry,
if
you're
from
switzerland
and
feel
offended
and
I'll
say,
block
I'll,
be
tough,
fair
to
say,
if
you
sign
in
with
this
account
from
switzerland,
I'm
going
to
block
you,
you
can
have
this
in
in
different
modes
here
report
only
which
is
good
to
see
what
is
happening.
A
Yep
like
this,
I
was
able
to
log
in,
but
if
I
switch
to
a
virtual
machine
that
I
have
deployed
and
try
to
do
the
same
first
I'll
prove
to
you
that
I'm
actually
in
switzerland
I'll
go
to
one
of
those
sites.
That
will
tell
you
your
breakout
ip
address
and
you'll,
see
that
this
is
in
zurich.
In
switzerland,
where
we
have
a
data
center
and
country
ch,
which
is
short
for
for
switzerland,
and
I
need
to
grab
the
url
that
sort
of
kickstarts
the
sign
inflow.
A
To
run
it
from
switzerland,
and
if
the
demogods
are
with
me,
I'm
using
the
right
yeah
and
try
to
sign
in
it
will
give
me
the
default
message.
I
can
change
this
to
say:
hey,
you
can't
do
this
you're
blocked,
and
this
is
conditional
access
that
kicks
in.
If
I
back
out,
run
the
same
policy
but
I'll
this
time,
just
for
fun,
I'll
use
the
ashrae
d
federated
account.
A
A
So
it's
only
blocking
me,
and
that
is
what
you
get
with
p2.
You
can't
get
this
without
p2.
So
if
you
want
to
start
building
your
policies,
you
need
p2.
If
you're
using
custom
policies,
you
can
be
more
granular
and
how
you
want
to
sort
of
behave
when
we
tell
you
that
there
is
a
something
that
needs
to
your
remediation.
A
A
Let's
see
four
minutes
left
so
I'll
try
to
go
through
the
questions
in
the
I
am
window
and
sorry
for
not
doing
this
earlier.
Do
you
need
a
dynamics?
365
subscription
good
question
dean?
No,
you
can
you
can
get
dynamics,
fraud,
protection,
standalone,
you
don't
need
to
have
dynamics.
The
complete
suite.
A
Do
you
recommend
creating
a
separate
ca
policy
for
b2c
apps?
You
need
to
because
I
mean
the
policy
lives
within
the
b2c
tenant.
You
cannot
sort
of
borrow
the
ones
that
you
have
from
your
enterprise.
I've
switched
directories
and
I'm
in
the
b2c
tenant
and
the
b2c
policy
blocked
me
in
switzerland.
It
only
lives
in
in
the
b2c
talent,
if
that,
if
we
understood
the
question
correct
custom
domain,
for
course
well,
it's
not
really
course.
A
A
Michael
long
you,
if
you
enable
conditional
access
in
the
tenant,
it
will
impact
the
user
signing
in
via
older
versions
of
the
browser,
yeah
you're,
absolutely
right.
You
need
to
be
careful
and
that's
why
I
recommend
that
you
run
it
in
report
only
for
a
while
to
see
what's
actually
happening.
So
you
don't
turn
this
on
monday
morning
and
all
of
a
sudden
you
get
you
get
angry
phone
calls
from
from
help
desk
saying
that
customers
cannot
sign
in
well.
Thank
you
dean.
A
A
If
you
do
the
initial
id
token
access
token,
and
you
haven't
configured
them
differently,
they
should
be
have
the
same
length,
but
I
mean
you
can
you
can
go
in
and
tweak
them
and
the
lifetime
of
it
on
behalf
of
support
is
not
supported
in
b2c,
that's
correct
and
that's
back
to
the
red
lego
piece
and
the
blue
lego
piece
and
the.
If
you
invoke
the
policy,
it
does
not
understand
the
on
behalf
low.
A
We
are
working
on
it,
so
we
plan
to
support
it
going
forward.
I
do
not
have
a
timeline
for
that.
Can
we
get
the
sample
code
up
it's
the
standard
if
you
search
for
azure,
adb
to
see
amstel
node
sample,
it's
that
if
it
is,
if
it
is
with
this
sort
of
the
token
cache,
etc,
I'll
I'll
add
the
link
to
another
github
reaper
for
the
tweak
code.
If,
if
you
want
to
use
that
any
questions,
I've
missed
before.
B
B
And
I
put
a
link
to
microsoft:
q,
a
if
we
didn't
get
to
your
question,
that's
a
great
place
to
go
and
add
your
question,
and
christopher
and
other
folks
from
microsoft
will
go
on
and
answer
your
questions
as
soon
as
you
can,
and
I
also
put
a
link
to
a
survey
if
you
want
to
provide
feedback
on
this
call
or
if
you
have
any
suggestions
for
topic.
Ideas
for
future
calls.
That
will
be
awesome
to
hear
as
well
from
you
so
that
we
can
meet
all
your
needs
and
thank
you
so
much
have.