Can Azure-AD B2C use a mobile telephone number as a username?

Question

We have a mobile app and website. We would like to use Azure AD-B2C for authentication. We are not going to allow any third party authentication, but instead just use Azure

Answer 1

This can be implemented as a custom policy, from the SocialAndLocalAccountsWithMfa starter pack where the end-user's phone number is stored as a sign-in name, with the following changes.

1) Create a custom attribute called PhoneVerified of type Boolean to represent whether the end-user's phone number has been verified.

2) In the TrustFrameworkBase.xml file, add the following claim types to the claims schema:

i. The phone claim type to represent how the end-user's phone number is entered. E.164 is the required format of this claim type:

  Phone Number
  string
  TextBox
  
    
  

ii. The signInNames.phoneNumber claim type to represent how the end-user's phone number is saved:

  Phone Number
  string
  TextBox

iii. The extension_PhoneVerified claim type to represent whether the end-user's phone number has been verified:

  Phone Number Verified
  boolean

3) In the TrustFrameworkBase.xml file, add the LocalAccountSignUpWithLogonPhone tehcnical profile to the Local Account claims provider and AAD-UserWriteUsingLogonPhone technical profile to the Azure Active Directory claims provider, for registering a new end-user with a phone number:

  Phone signup
  
  
    IpAddress
    api.localaccountsignup
    Create
  
  
    
  
  
    
    
    
    
    
    
    
    
    
    
    
  
  
    
  
  

  
    Write
    true
  
  false
  
    
  
  
    
    
    
    
    
    
    
    
    
  
  
    
    
    
    
    
  
  
  

The end-user's phone number is saved as a sign-in name of type phoneNumber and whether the end-user's phone number has been verified is set to false.

4) In the TrustFrameworkBase.xml file, add a SelfAsserted-LocalAccountSignin-Phone technical profile to the Local Account claims provider, for logging in an existing end-user with a phone number:

  Local Account Signin
  
  
    SignUpWithLogonPhoneExchange
    Username
    api.selfasserted
  
  false
  
    
  
  
    
    
    
    
  
  
    
  
  

The setting.operatingMode setting is set to Username so that the logon identifier field doesn't have the required format of an email address.

5) In the TrustFrameworkBase.xml file, add a AAD-UserReadForPhoneUsingObjectId technical to the Azure Active Directory claims provider, for getting the end-user's object including the phone profile:

  
    Read
    true
  
  false
  
    
  
  
    
    
    
    
    
  
  

6) In the TrustFrameworkBase.xml file, add a PhoneFactor-Verify technical profile to the Phone Factor claims provider, for verifying the end-user's phone number:

  PhoneFactor
  
  
    api.phonefactor
    false
  
  
    
  
  
    
  
  
    
    
  
  
    
  
  

7) In the the TrustFrameworkBase.xml file, add an UserWritePhoneVerifiedUsingObjectId technical profile to the Azure Active Directory claims provider, for setting whether the end-user's phone number has been verified to true:

  
    Write
    false
    true
  
  false
  
    
  
  
    
    
  
  

Note: Additional technical profiles must be added in the TrustFrameworkBase.xml file to allow an existing end-user to reset their current password using a phone number but this has been left as an exercise for the reader.

8) In the TrustFrameworkBase.xml file, add a SignUpOrSignInForPhone user journey, which allows either a new end-user to register with a phone number or an existing end-user to log in with a phone number and then verifies the end-user's phone number.

  

          
    
      
        
      
      
        
      
    

    
    
      
        
          objectId
          SkipThisOrchestrationStep
        
      
      
        
      
    

    
    
      
        
      
    

    
    
      
        
          extension_PhoneVerified
          True
          SkipThisOrchestrationStep
        
        
          isActiveMFASession
          SkipThisOrchestrationStep
        
      
      
        
      
    

    
    
      
        
          extension_PhoneVerified
          True
          SkipThisOrchestrationStep
        
        
          isActiveMFASession
          SkipThisOrchestrationStep
        
      
      
        
      
    

    

  

9) Create a relying party file called SignUpOrSignInForPhone.xml (or similar) and reference the SignUpOrSignInForPhone user journey:

  
    yourtenant.onmicrosoft.com
    B2C_1A_TrustFrameworkExtensions
  
  
    
    
      PolicyProfile
      
      
        
        
        
        
        
        
      
      
    
  

The token claims that are output to a relying party include:

i. The phone_number claim that represents the end-user's phone number.

ii. The phone_number_verified claims that represents whether the end-user's phone number has been verified.