SSO in Azure B2C using ExternalAD email address with fallback to Internal B2C email address

Question

I have SSO with Azure B2C working fine using in-tenant and email. I would like to add the ability for users to login in with ExternalAzureAd such that if the enter their email address and password it will first use ExternalAzureAd if they have already been invited or if not fallback to the B2C tenant. I can "see" whether on not a particular email address is Internal or External by viewing the users in B2C Users screen in the portal. I am rather surprised that out of the box the user is not forwarded to the appropriate login screen for authentication - either B2C or External - based on this information. So I have been told one way to possible implement this is to create an API app that will look this up based on user profile and then based on the info branch to either the Internal or External login screen. This would involve creating custom policie(s) and perhaps custom user flow(s) so that the API call in ingested into the user flow.

Has anyone done this or know of a reason this would not work?

Answer 1

I assume that by "ExternalAzureAd", you mean another Azure AD tenant you have federated with?

If so, you can automatically redirect based on the domain name.

Refer to the "Home Realm Discovery" samples here.