This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(32, 3%, 13%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ESL%3C/text%3E%3C/svg%3E)
Hi everyone,
I am writing here the issue that I am facing while working on sign-in workflow with Azure AD B2C. Your help is appreciated.
Pre-requisites:
I have Azure AD B2c tenant. I want to set up sign-in workflow with google as an IdP.
I have set up user flow for google .
Actual output:
When user tries to access the application then navigated to authentication from google - as expected.
once authenticated then error shows as "AADB2C99002: User does not exist. Please sign up before you can sign in."
I tried to create consumer user with google as identity via APIs and user is created but still it gives error as "AADB2C99002: User does not exist. Please sign up before you can sign in."
Questions:
Thanks in advance,
Shital
Can we migrate users from external IDP to Azure AD B2C as consumer users with username only (and not password) and issuer as external IDP name?
Hello @shitallawhale-8639, the error AADB2C99002 is being thrown due your google user/identity lacking a matching backing Azure AD B2C user. Remove the user account created via the API and sign-in again. The backing Azure AD B2C user will get automatically created.
If you want to create federated users programmatically, please follow Example 2: Create a user with social and local account identities.
Let us know if this answer was helpful to you or if you need additional assistance. If it was helpful, please remember to accept it so that others in the community with similar questions can more easily find a solution.
Hi @Alfredo Revilla - Senior Freelance SWE, SWA, IAM ,
Thanks for your response. I created a user as mentioned in "Example 2: Create a user with social and local account identities". But still getting error as AADB2C99002.
A user is created with multiple issuer to it. I failed to attach a screenshot here. But below are the details about issuers, signInType, issuerAssigned Id-
issuers- signInType- issuerAssigned Id as
google federated, <google email Id say anon@USER >
<b2c_tenant>.onmicrosoft.com emailAddress <google email Id say anon@USER >
<b2c_tenant>.onmicrosoft.com userName abc
<b2c_tenant>.onmicrosoft.com userPrincipalName, <This is auto generated id with @<b2c_tenant>.onmicrosoft.com
But on users console it shows User with userPrincipalName as anon@USER - which is expected.
As you mentioned "lacking a matching backing Azure AD B2C user" -> Do I need to create another user which will be created as "Azure AD" as source or the user I created with multiple issuers should suffice?
Thanks,
Shital
I found one workaround with custom policy - I commented step 4 <OrchestrationStep Order="4" > from TrustFrameworkExtensions.xml file. This skips the create screen and user is created automatically.
Hello @shital.lawhale , thanks for sharing your findings!
Hi @Alfredo Revilla - Senior Freelance SWE, SWA, IAM
We have a similar issue however slightly different.
We have followed this link https://learn.microsoft.com/en-us/azure/active-directory-b2c/identity-provider-azure-ad-multi-tenant?pivots=b2c-custom-policy to make use of multi tenant federation.
My scenario is that we have Tenant A(Azure AD) and Tenant B(Azure AD B2C).
Tenant A: We have existing users in Azure AD (now Entra) which is acting as the IDP
Tenant B: The existing user's from Azure AD (Tenant A) are Signing in to Azure AD B2C Custom policy in Tenant B.
Issue: In this process an member user account in Azure AD B2C is being created in Tenant B whenever an existing user from Tenant A is signing in using the azure AD B2C custom policy in Tenant B.
Solution: We are expecting the member account should not be created, we only need Azure AD (Tenant A) to act as the IDP and users is signing in to the azure b2c custom policy in Tenant B to be redirected to application.
And also can you give more details around your comment **"**the error AADB2C99002 is being thrown due your google user/identity lacking a matching backing Azure AD B2C user"