Does Azure AD B2C Custom Policy OIDC Federation Support PKCE?

Hi everyone,

I’m integrating Azure AD B2C custom policies with an external OIDC IdP (Keyless, which sits on Keycloak). The IdP requires PKCE (code_challenge, code_challenge_method) on the authorization request.

Here’s what I’ve tried so far:

My questions:

Does Azure AD B2C custom policy federation to an external OIDC provider support PKCE at all?

If not, is the only option to configure the external IdP client without requiring PKCE?

Is there an undocumented metadata key for enabling PKCE (code_challenge, code_challenge_method), or is this limitation by design?

Any guidance would be appreciated I want to confirm whether I should push for PKCE to be disabled on the IdP side, or whether there’s a supported way to enable it in B2C custom policies.

Thanks, Ray