CODEWITHSUNDEEP
azureoauth-2.0azure-ad-b2copenid-connect
Ryan.Bartsch
Ryan.Bartsch

Reputation: 4200

Azure AD B2C - include mobile phone number used for MFA in id token

I'm using Azure AD B2C.

I've created a Sign up v2 user flow with multifactor authentication enabled. When I run the user flow and go through the sign up process including MFA via SMS to my specified mobile phone number, I'm returned to the reply URL that I've configured - jwt.ms.

The id token has return claims including my email address as well as other attributes that I've configured to return, but nothing regarding the mobile phone number used for MFA. There doesn't appear to be a way to configure the user flow to include this in the return claims. Does anyone know if this is possible and if so, how to do it?

Cheers.

Upvotes: 0

Views: 1496

Answers (1)

Chris Padgett
Chris Padgett

Reputation: 14654

The phone number is read from and written to the strongAuthenticationPhoneNumber property of the user object.

Currently, this property is not available to a built-in policy (i.e. a user flow), but it is available to a custom policy.

If you use the custom policy starter pack for MFA, then you can add the strongAuthenticationPhoneNumber claim, as an outgoing claim in the ID token, as follows:

<RelyingParty>
  <DefaultUserJourney ReferenceId="SignUpOrSignIn" />
  <TechnicalProfile Id="PolicyProfile">
    <DisplayName>PolicyProfile</DisplayName>
    <Protocol Name="OpenIdConnect" />
    <OutputClaims>
      ...
      <OutputClaim ClaimTypeReferenceId="strongAuthenticationPhoneNumber" PartnerClaimType="phone_number" />
    </OutputClaims>
    <SubjectNamingInfo ClaimType="sub" />
  </TechnicalProfile>
</RelyingParty>

Upvotes: 2

Related Questions