User profile attributes

Your Azure Active Directory B2C (Azure AD B2C) directory user profile comes with a set of built-in attributes, such as given name, surname, city, postal code, and phone number. You can extend the user profile with your own application data without requiring an external data store.

Microsoft Graph API supports most of the attributes that you can use with Azure This article describes user profile attributes that Azure AD B2C supports. It also notes those attributes that Microsoft Graph doesn't support, and Microsoft Graph API attributes that Azure AD B2C shouldn't use.

You can also integrate with external systems. For example, you can use Azure AD B2C for authentication, but delegate to an external customer relationship management (CRM) or customer loyalty database as the authoritative source of customer data. For more information, see the remote profile solution.

Microsoft Entra user resource type

Azure AD B2C directory user profile supports the user resource type attributes listed in the table below. It gives the following information about each attribute:

• Attribute name used by Azure AD B2C (followed by the Microsoft Graph name in parentheses, if different)
• Attribute data type
• Attribute description
• Whether the attribute is available in the Azure portal
• Whether the attribute can be used in a user flow
• Whether the attribute can be used in a custom policy Microsoft Entra ID technical profile and in which section (<InputClaims>, <OutputClaims>, or <PersistedClaims>)

¹ Not supported by Microsoft Graph
² For more information, see MFA phone number attribute
³ Shouldn't be used with Azure AD B2C

Required attributes

To create a user account in the Azure AD B2C directory, provide the following required attributes:

• Display name

• Identities - With at least one entity (a local or a federated account).

• Password profile- If you create a local account, provide the password profile.

Display name attribute

The displayName is the name to display in Azure portal user management for the user, and in the access token that Azure AD B2C returns to the application. This property is required.

Identities attribute

A customer account, which could be a consumer, partner, or citizen, can be associated with these identity types:

• Local identity - The username and password are stored locally in the Azure AD B2C directory. We often refer to these identities as "local accounts."
• Federated identity - Also known as a social or enterprise accounts, the identity of the user is managed by a federated identity provider like Facebook, Microsoft, ADFS, or Salesforce.

A user with a customer account can sign in with multiple identities. For example, username, email, employee ID, government ID, and others. A single account can have multiple identities, both local and social, with the same password.

In the Microsoft Graph API, both local and federated identities are stored in the user identities attribute, which is of type objectIdentity. The identities collection represents a set of identities used to sign in to a user account. This collection enables the user to sign in to the user account with any of its associated identities. The identities attribute can contain up to 10 objectIdentity objects. Each object contains the following properties:

The following JSON snippet shows Identities attribute, with a local account identity with a sign-in name, an email address as sign-in, and with a social identity.

"identities": [
  {
    "signInType": "userName",
    "issuer": "contoso.onmicrosoft.com",
    "issuerAssignedId": "johnsmith"
  },
  {
    "signInType": "emailAddress",
    "issuer": "contoso.onmicrosoft.com",
    "issuerAssignedId": "[email protected]"
  },
  {
    "signInType": "federated",
    "issuer": "facebook.com",
    "issuerAssignedId": "5eecb0cd"
  }
]

For federated identities, depending on the identity provider, the issuerAssignedId is a unique value for a given user per application or development account. Configure the Azure AD B2C policy with the same application ID that the social provider or another application within the same development account assigns.

Password profile property

For a local identity, the passwordProfile attribute is required, and contains the user's password. The forceChangePasswordNextSignIn attribute indicates whether a user must reset the password at the next sign-in. To handle a forced password reset, use the instructions in set up forced password reset flow.

For a federated (social) identity, the passwordProfile attribute isn't required.

"passwordProfile" : {
    "password": "password-value",
    "forceChangePasswordNextSignIn": false
  }

Password policy attribute

The Azure AD B2C password policy (for local accounts) is based on the Microsoft Entra ID strong password strength policy. The Azure AD B2C sign-up or sign-in and password reset policies require this strong password strength, and don't expire passwords.

In user migration scenarios, if the accounts you want to migrate have weaker password strength than the strong password strength enforced by Azure AD B2C, you can disable the strong password requirement. To change the default password policy, set the passwordPolicies attribute to DisableStrongPassword. For example, you can modify the create user request as follows:

"passwordPolicies": "DisablePasswordExpiration, DisableStrongPassword"

MFA phone number attribute

When using a phone for multifactor authentication (MFA), the mobile phone is used to verify the user identity. To add a new phone number programmatically, update, get, or delete the phone number, use MS Graph API phone authentication method.

In Azure AD B2C custom policies, the phone number is available through strongAuthenticationPhoneNumber claim type.

Extension attributes

Every customer-facing application has unique requirements for the information to be collected. Your Azure AD B2C tenant comes with a built-in set of information stored in properties, such as Given Name, Surname, and Postal Code. With Azure AD B2C, you can extend the set of properties stored in each customer account. For more information, see Add user attributes and customize user input in Azure Active Directory B2C

Extension attributes extend the schema of the user objects in the directory. The extension attributes can only be registered on an application object, even though they might contain data for a user. The extension attribute is attached to the application called b2c-extensions-app. Don't modify this application, as it's used by Azure AD B2C for storing user data. You can find this application under Microsoft Entra App registrations. Learn more about Azure AD B2C b2c-extensions-app.

Extension attributes in the Graph API are named by using the convention extension_ApplicationClientID_AttributeName, where:

• The ApplicationClientID is the Application (client) ID of the b2c-extensions-app application. Learn how to find the extensions app.
• The AttributeName is the name of the extension attribute.

The Application (client) ID when used to create the name of the extension attribute doesn't include hyphens. For example:

"extension_831374b3bd5041bfaa54263ec9e050fc_loyaltyNumber": "212342"

The following data types are supported when defining an attribute in a schema extension:

Next steps

Learn more about extension attributes:

• Schema extensions
• Define custom attributes