CODEWITHSUNDEEP
navigationazure-active-directorymobile-applicationazure-ad-b2c
Bhoomika Arora
Bhoomika Arora

Reputation: 115

Does Azure Active Directory B2C offer edit profile options?

We're trying to build a connected solution using Azure. We offer the user an option to sign up via an email account or sign in via a social networking site using Azure B2C on a mobile application. We also want the user to have an option to edit their details like name, password etc.

Currently, it is implemented as follows:

Any details other than password can be changed after asking the user to sign in again. Password is changed via the Forgot password function. (with literally the user being a sent a reset link and title being 'Forgot password'

These are not quite right from a user's perspective. Is Azure B2C limiting this functionality in any way? Is it possible to make it more user friendly such as

All details can be edited without signing in again. Changing password is allowed after providing the old password.

At the very least, it should be possible to update the title / flow of these functions.

Upvotes: 1

Views: 606

Answers (2)

Fei Xue
Fei Xue

Reputation: 14649

There are two kinds of account in Azure AD B2C. One is local account and the another is social account.

We are only able to update the password of local account since Azure AD manages the password for local account.

And no matter what kind of application, we can using the Microsoft Graph to update the profile. Here is a sample to update the password for your reference:

PATCH:https://graph.microsoft.com/v1.0/users/{userId}
Authorization: Bearer {access_token}
{
     "passwordProfile": {
        "password": "newPassword",
        "forceChangePasswordNextSignIn":false
    }
}

And more detail about user updating, you can refer link below:

Update User

Upvotes: 2

Ramakrishna
Ramakrishna

Reputation: 5038

I hope you are doing a web application, not a Native application.

All details can be edited without signing in again.

This can be done by enabling SSO.

You need to enable SSO across the policies. You can do this from edit policy -> Token, session & SSO config -> Single sign-on configuration

Changing password is allowed after providing the old password.

It leads to the security issue and not a good practice to allow the user to modify his password without a cross verification.

If you still want to compromise, check with Graph API. If you find any API which updates password through your application then create a custom page in your application to process the flow.

HTH

Upvotes: 0

Related Questions