B2C identity provider - sub and oid claim mismatch

[bolt-io]

Using the new developer portal experience with MSAL pointing to Azure AD B2C with custom policies.

It seems that if the jwt returned by B2C custom policies has a different object ID than the sub claim, the user will not be created. A post to the /users endpoint returns a 403 http code and the following response:

{
    "error": {
        "code": "AccessDenied",
        "message": "Exception of type 'Microsoft.WindowsAzure.ApiManagement.Management.Core.Extensions.AccessDeniedException' was thrown.",
        "details": null
    }
}

We have confirmed that once the oid and sub claims match, the user's are created successfully and the /users endpoint returns a 201 http code.

Is this expected?

Note, the reason the oid and sub do not match is due to using Azure AD B2C with local accounts (works fine as oid and sub match) and federated with Azure AD. When federating with Azure AD we use the Azure AD object ID to maintain APIM access/subscriptions they had before.

---

Document Details

⚠ Do not edit this section. It is required for learn.microsoft.com ➟ GitHub issue linking.

• ID: 18a8a3ac-153d-90b9-4c66-cc6207eaafac
• Version Independent ID: 35488468-4002-093e-1155-00c7fd063d13
• Content: Authorize developer accounts by using Azure Active Directory B2C - Azure API Management
• Content Source: articles/api-management/api-management-howto-aad-b2c.md
• Service: api-management
• GitHub Login: @dlepow
• Microsoft Alias: danlep

[Naveenommi-MSFT]

@bolt-io Thanks for your feedback! We will investigate and update as appropriate.

[dlepow]

@bolt-io. I apologize for the delay responding to your issue. I have forwarded your issue to our engineering team to comment. Thanks!

assign: @ygrik

[dlepow]

Thanks for raising this issue in Azure documentation. Unfortunately, at this time we have been unable to review or resolve your issue in a timely manner and we sincerely apologize for the delayed response. We have captured your feedback for consideration in future documentation updates and are now closing this issue. To discuss further, you can also get answers from community experts in Microsoft Q&A. If you have a support plan and you need technical help, create an Azure support request.

please-close