Create and configure a Microsoft Entra application for account manager sign-in

To create a Microsoft Entra application for account manager sign-in in the Azure business-to-business (B2B) tenant, follow these steps:

1. Sign in to the Azure portal.

2. Go to the directory that contains the Microsoft Entra business-to-business (B2B) tenant that you use for sign-in in headquarters.

3. In the row of Azure services, select Microsoft Entra ID.

4. On the Manage menu, select App Registration, and then select New Registration.

5. Enter a name for the application (for example, Account Manager Employer Auth).

6. Under Supported account types, select Accounts in this organizational directory only (<YOUR-TENANT-NAME> only - Single tenant), where <YOUR-TENANT-NAME> is the name of your tenant.

7. Under Redirect URI, select Web, and then, in the URL field, enter https://<your-tenant-name>.b2clogin.com/<your-tenant-name>.onmicrosoft.com/oauth2/authresp, where <your-tenant-name> is the name of your tenant. If you use a custom domain, enter https://<your-domain-name>/<your-tenant-name>.onmicrosoft.com/oauth2/authresp, where <your-domain-name> is your custom domain.

   Note

   Use lowercase letters when you enter your tenant's name, even if the tenant is defined with uppercase letters in Microsoft Entra ID B2C. For example, enter https://adventure-works.b2clogin.com/adventure-works.onmicrosoft.com/oauth2/authresp.

8. Select Register.

To create a Microsoft Entra application for account manager sign-in in the Azure business-to-business (B2B) tenant, follow these steps:

1. Sign in to the Azure portal.

2. Go to the directory that contains the Microsoft Entra business-to-business (B2B) tenant that you use for sign-in in headquarters.

3. In the row of Azure services, select Microsoft Entra ID.

4. On the Manage menu, select App Registration, and then select New Registration.

5. Enter a name for the application (for example, Account Manager Employer Auth).

6. Under Supported account types, select Accounts in this organizational directory only (<YOUR-TENANT-NAME> only - Single tenant), where <YOUR-TENANT-NAME> is the name of your tenant.

7. Under Redirect URI, select Web, and then add the following redirect URLs:

   • https://<EEID-tenant-subdomain>.ciamlogin.com/<EEID-tenant-ID>/federation/oauth2
   • https://<EEID-tenant-subdomain>.ciamlogin.com/<EEID-tenant-subdomain>.onmicrosoft.com/federation/oauth2

   Replace <EEID-tenant-subdomain> with the subdomain of your Microsoft Entra External ID (EEID) tenant - This is the tenant where the consumer or customer user data resides, not the employee or B2B tenant. Replace <EEID-tenant-ID> with the EEID tenant's directory (tenant) ID. For example, if your EEID tenant subdomain is contoso-customers and the tenant ID is aaaa1111-bb22-cc33-dd44-eeee5555ffff, the redirect URIs would be https://contoso-customers.ciamlogin.com/aaaa1111-bb22-cc33-dd44-eeee5555ffff/federation/oauth2 and https://contoso-customers.ciamlogin.com/contoso-customers.onmicrosoft.com/federation/oauth2.

   Note

   Use lowercase letters when you enter your tenant's subdomain, even if the tenant is defined with uppercase letters in Microsoft Entra ID.

8. Select Register.

After you complete the registration, find the application that you created (for example, Account Manager Application).

1. In the Essentials section, copy and save the Application (Client) ID value. This value is a globally unique identifier (GUID) (for example, "00001111-aaaa-2222-bbbb-3333cccc4444").

2. Select Add an Application ID URI.

3. Select Add a scope. The portal generates an application ID URI for you.

4. Select Save and continue.

5. For Scope name, enter "user_impersonation".

6. For Admin consent display name, enter "obo user impersonation", or any other name.

7. For Admin consent description, enter "obo user impersonation", or any other description.

8. Select Save.

9. In the left menu, under Manage, select Certificates & secrets.

10. Select New client secret.

11. In the Description field, enter a description of the client secret (for example, "clientsecret1").

12. Under Expires, select the date when the secret expires.

13. Select Add.

14. Copy and save the secret value to use later.

    Important

    Make sure you copy the secret value. It doesn't appear again after you leave the Certificates & secrets page.

After you complete the registration, find the application that you created (for example, Account Manager Application).

1. In the Overview section, copy and save the Application (Client) ID value. This value is a globally unique identifier (GUID) (for example, "00001111-aaaa-2222-bbbb-3333cccc4444").

2. In the left menu, under Manage, select Certificates & secrets.

3. Select New client secret.

4. In the Description field, enter a description of the client secret (for example, "clientsecret1").

5. Under Expires, select the date when the secret expires.

6. Select Add.

7. Copy and save the secret value to use later.

   Important

   Make sure you copy the secret value. It doesn't appear again after you leave the Certificates & secrets page.

To configure an identity provider in your Azure B2C tenant for account manager sign-in to a B2B site, follow these steps:

1. Go to the directory that contains your Microsoft Entra B2C tenant. On the top menu, select the Directory + subscription filter, and then select the directory that contains your Microsoft Entra B2C tenant.

2. In the upper-left corner of the Azure portal, select All services. Search for and select Microsoft Entra ID B2C.

3. Select Identity providers, and then select New OpenID Connect provider.

4. In the Name field, enter StoreManagerB2BSignin. You must use this exact name; don't modify it.

   Important

   For on behalf of sign-in to work, the identity provider name must match the ID used in your sign-in module. The default value is StoreManagerB2BSignin.

5. In the Metadata url field, enter the URL of the Azure B2B OpenID Connect (OIDC) configuration document. For example, use https://login.microsoftonline.com/<TENANT-ID>/v2.0/.well-known/openid-configuration, where <TENANT-ID> is the ID of your Microsoft Entra B2B tenant.

   Important

   The OIDC configuration document URL must use HTTPS.

6. In the Client ID field, enter the application ID that you copied earlier.

7. In the Client secret field, enter the client secret that you copied earlier.

8. In the Scope field, enter openid profile <Azure-B2B-Application-ID-URI>/user_impersonation, where <Azure-B2B-Application-ID-URI> is the ID of the Azure B2B Microsoft Entra application. For example, use openid profile api://00001111-aaaa-2222-bbbb-3333cccc4444/user_impersonation. The Scope field format must be openid profile <scope-name>, where <scope-name> is the scope name you created in the Create a Microsoft Entra application for account manager sign-in in the Azure B2B tenant procedure.

9. In the Response type field, select code.

10. In the Response mode field, select form_post.

11. Under Identity provider claims mapping, select the following claims:

    1. For User ID, select sub.
    2. For Display name, select name.
    3. For Given name, select given_name.
    4. For Surname, select family_name.
    5. For Email, select email.

12. Select Save.

To configure your Microsoft Entra B2B tenant as a custom OpenID Connect (OIDC) identity provider in your external tenant, follow these steps:

1. On the Azure portal, go to the directory that contains your Microsoft Entra External ID tenant.

2. Browse to Entra ID > External Identities > All identity providers.

3. Select the Custom tab, and then select Add new > Open ID Connect.

4. In the Display name field, enter StoreManagerB2BSignin or a custom name for the OBO signin page.

5. In the Well-known endpoint field, enter the URL of the Azure B2B OpenID Connect (OIDC) configuration document. For example, use https://login.microsoftonline.com/organizations/v2.0/.well-known/openid-configuration.

   Important

   The OIDC configuration document URL must use HTTPS.

6. In the OpenID Issuer URI field, enter the issuer of your Microsoft Entra B2B tenant. For example, use https://login.microsoftonline.com/<TENANT-ID>/v2.0, where <TENANT-ID> is the ID of your Microsoft Entra B2B tenant.

7. In the Client ID field, enter the application ID that you copied earlier.

8. In the Client secret field, enter the client secret that you copied earlier.

9. For Client authentication, select client_secret_post.

10. In the Scope field, enter openid profile.

11. In the Response type field, select code.

12. Select Next: Claims mapping, and then map the following claims:

    1. For Name, replace value with oid.

13. Select Review + create to add your identity provider.

To add the Azure identity provider to a user flow, follow these steps:

1. In your Microsoft Entra B2C tenant, select User flows.
2. Select the user flow that you want to add the identity provider to.
3. Under Custom identity providers, select the identity provider that you added in the Create a Microsoft Entra application for account manager sign-in in the Azure B2B tenant step.
4. In Application Claims, select Identity Provider Access Token, Identity Provider, Email address, Given Name, and Surname.
5. Select Save.

To add the OIDC identity provider to a user flow, follow these steps:

1. In your external tenant, go to Entra ID > External Identities > User flows.
2. Select the user flow that's configured for sign-in or sign-up on your B2B e-commerce site.
3. Under Settings, select Identity providers.
4. Under Other Identity Providers, select the StoreManagerB2BSignin OIDC identity provider that you added in the Configure an identity provider in your Azure B2C tenant for account manager sign-in to a B2B site step.
5. Select Save.
6. Under Customize, select Page layouts. On the User Flow Attributes tab, select the username attribute. In the Edit Username pane, clear the Collect from user and Editable checkboxes, and then select OK.

In Azure AD B2C, the user impersonation scope is exposed directly on the application you created in previous steps. It doesn't need any separate configuration.

For Microsoft Entra External ID, the on behalf of (OBO) flow requires a separate Microsoft Entra application created in your external (EEID) tenant that exposes a user impersonation scope. You then grant the app registration used for sign-in into the site permission to that scope. To create this application and expose the scope, follow these steps:

1. On the Azure portal, go to the directory that contains your Microsoft Entra External ID tenant.
2. Go to Entra ID > App registrations, and then select New registration.
3. Enter a name for the application (for example, OBO Impersonation AppReg).
4. Under Supported account types, select Accounts in this organizational directory only (<YOUR-TENANT-NAME> only - Single tenant), where <YOUR-TENANT-NAME> is the name of your external tenant.
5. Select Register.
6. In the Essentials section, copy and save the Application (Client) ID value. You need this value when you grant the scope to the sign-in application.
7. On the Manage menu, select Expose an API.
8. Next to Application ID URI, select Add, accept the generated URI (api://<client-id>), and then select Save.
9. Select Add a scope.
10. For Scope name, enter "user_impersonation".
11. For Who can consent?, select Admins only.
12. For Admin consent display name, enter "obo user impersonation", or any other name.
13. For Admin consent description, enter "obo user impersonation", or any other description.
14. For State, select Enabled.
15. Select Add scope.

In Azure AD B2C, the user impersonation scope is added directly on the OIDC provider in the previous steps. You don't need any separate configuration.

After you expose the scope, grant it to the Microsoft Entra External ID app registration that the B2B ecommerce site uses for sign-in. To grant the scope, follow these steps:

1. In your external (EEID) tenant, go to Entra ID > App registrations, and then open the app registration used for sign-in into the site.
2. On the Manage menu, select API permissions.
3. Select Add a permission, and then select the APIs my organization uses tab.
4. Select the application that exposes the scope (for example, OBO Impersonation AppReg).
5. Select Delegated permissions, select the user_impersonation scope, and then select Add permissions.
6. Select Grant admin consent for <YOUR-TENANT-NAME>, and then select Yes to confirm. Verify that the Status column shows Granted for <YOUR-TENANT-NAME>.

This step isn't required for Azure AD B2C setup.

You also need to add the scope to the site authentication profile that your site uses, so that the OBO token requested at sign-in includes the user impersonation scope. To add the scope, follow these steps:

1. In Commerce site builder, go to Tenant settings > Site authentication setup.
2. Select the site authentication profile that your site uses (for example, EntraExternal) to open the Edit site authentication profile dialog box.
3. In the Scope field, enter the user impersonation scope that you exposed earlier, in the format api://<obo-api-client-id>/user_impersonation, where <obo-api-client-id> is the Application (Client) ID of the app registration that exposes the scope (for example, Account Manager OBO API).
4. Select OK, and then select Save.