Azure AD B2C – are client to backend to B2C calls problematic?

Thanks for reaching out.

Please find the inline response:

we stumbled upon parts of the B2C documentation that indicates that B2C calls are meant to be called from a client directly due to Microsoft Entra ID Protection

Azure AD B2C endpoints are designed to be called directly from clients (browsers/apps) because B2C endpoints are optimized to identify user behavior patterns, geographic locations, and IP addresses.

When a client calls an Azure AD B2C endpoint directly, the Identity Protection service can detect and respond to any suspicious activity in real-time which secure your application.

However, you can secure those endpoints further using Web Application Firewall (WAF) and Azure Front Door (AFD).

the identity protection at some point might consider our API as malicious and blacklist the its IP-address

To avoid the risk of your API being considered malicious and blacklisted by the Identity Protection service, you should ensure that your API is secure and follows best practices for web application security. This includes implementing measures such as rate limiting, input validation, and authentication and authorization controls to prevent unauthorized access and abuse.

the request limit is further limited per IP address:

The frequency of requests made to Azure AD B2C endpoints determines the overall token issuance capability, and you can optimize the token issuance rate by follow the best practices as mentioned here learn.microsoft.com/en-us/azure/active-directory-b2c/service-limits?pivots=b2c-user-flow#best-practices

Therefore, it is recommended that you call Azure AD B2C endpoints directly from your clients (browsers/apps) to ensure that you are taking advantage of the real-time protection provided by the Identity Protection service and to avoid any potential issues with request limits.

Hope this will help.

Thanks,

Shweta

Please “Accept the answer” if above answer helps you.