Azure AD B2C - Use Graph API to populate “Authentication Email”

Question

Is there a way we can populate the “Email” field for the user via Graph API in Azure AD B2C. There is a section “Authentication contact info” under the user profile, which has a field “Email” which is a read-only field when accessed via Graph API and cannot be populated programmatically. I am able to use Graph API to populate the “Alternate email”. However for the reset password policy (user clicks the forgot password link), the “Email” field is a required field I am unable to use the “Alternate email” in the reset password policy

Answer 1

Only Authentication contact info: Alternate email can be modified via the Azure AD Graph at this time. You can achieve this by sending a Patch request as follows:

PATCH https://graph.windows.net/yourtenant.com/users/youruser@yourtenant.onmicrosoft.com
{
  "otherMails": [
    "newalternateemail@hotmail.com"
  ]
}

The Authentication contact info: Email field is only editable via the portal at this time.

Answer 2

Seems like Authentication contact info: Email field is NOT editable even via the portal now. Not sure what changed in the Azure AD B2C infrastructure. Anyone know of any other work around to edit the Authentication contact info: Email field. Our users are unable to reset their password ... Any help is greatly appreciated

Answer 3

This is a direct answer from Microsoft Support

Issue: You are not able to modify the Authentication Contact Info

Environment:

• B2C Tenant
• You are a global admin of that Tenant.
• You are able to see the information but not to modify.
• Specific attributes what we are talking about: - Phone - Alternate phone - Email - Alternate email

Facts:

• You have tried to do the same action in your personal environment in order to confirm if could be an isolated issue but the result was negative, you are not able to modify any attribute on that B2C tenant.

• We have tried the same operation in our B2C tenant with our personal account, as a global admin, the result was also negative.

Findings:

• This behavior was detected by others engineers, same scenario, same issue. Global administrators cannot edit the Authentication Contact Info through the portal anymore.
• It is possible to modify this information through PowerShell, nevertheless we are not sure how longer is going to be possible to do it.
• This seems to be an unexpected behavior of the Azure Platform, we do not have enough information yet to confirm it.

We are still analyzing this case and we would provide you more information as soon as we have new results.

Will keep this updated as I hear from Microsoft Support