Morning everyone,
I'm trying to understand the feasibility of an integration between:
external website, Azure B2C, SSO and Microsoft Teams. The idea is the following: users land on website, where they register/auth via SSO offered by Azure on an external identity provider. Once their account is stored on the website ( and eventually on Azure B2C ), they should be able to login to Teams with the account they used to register/signin via SSO.
I know that accounts inside a standard Azure Active Directory can access the same domain/tenant via Microsoft Teams.
- Can we do the same if the Directory is a B2C directory ?
About the B2C & SSO, this is the setup:
- Azure B2C Directory
- Custom app registered into the Azure AD ( used to interact with Azure AD via Microsoft Graph API )
- SSO using external identity providers ( like Google, Microsoft, Facebook, etc. etc. )
Let's say everything is already set up ( connections, user flow, policies, etc. etc. ). Now this is my sample flow:
- new (unknown for both system, Azure and owned system ) user lands on external login
- use choose login via one of the available identity provider
- let's say he will use google ( for example )
- will insert google credentials email+password
- user will be authenticated via SSO offered by Azure B2C
- OIDC token and data is transfered to final endpoint configured by the application/user flow/policies
Now what I don't get is :
- Does the B2C Directory register and store this user by itself once they register/signin via SSO?
- Is the SSO related somehow to the Azure Users or it is a simple SSO system offered via Azure?
- Since Teams allows login mainly from members under the domains list of the Azure Directory, how would be possible for a user with ( sample ) a google.com email to login into a custom Teams, related to the B2C Directory?
- Will be able the custom app, registered in the Azure B2C Directory, to access users via Microsoft Graph and eventually act "as user" via the SSO token using the Delegated permission
I stared my study here : https://docs.microsoft.com/en-us/azure/active-directory-b2c/overview but there's no precise explanation about how the process work underneath
