Azure AD B2C block sign in from external identity providers

Question

Newly created users coming from an external identity providers will also be created in the directory. They also have a setting called "block sign-in".

It seems that this is not honored in my directories, only for local users. I can sign in with users marked as "blocked".

Additionally, it seems that the default for all of my users currently "block" which is wrong.

Is this working as designed?

Answer 1

At this time, it is only possible to disable local accounts in Azure AD B2C. You can achieve this by setting Block sign in to Yes for the local accounts that you want to block.

As you've observed, external accounts (such as those from social identity providers Facebook, Google, etc), don't honor this setting. This is expected behavior at this time.

If you'd like to be able to disable sign-in for social accounts as well, I'd recommend you create an entry in the Azure AD B2C feedback forum requesting this feature.

Also see: How to de-active and re-active user in azure AD B2C

Answer 2

Yes, we can implement,

• Create an Azure Function which gets called on the Sign-up flow.

• In the AF, check the domain & call a logic app

• In the Logic App,call the Graph API, which creates the user & blocks the user.

  "accountEnabled": false, "displayName": @{variables('strDisplayName')}, "givenName": @{variables('strGivenName')}

so this solves the issue.