B2C Tenant Registry¶

Monitor credential expiry in your Azure AD B2C tenants to prevent authentication failures in customer-facing applications.

Overview¶

The B2C Tenant Registry allows CertifyClouds to scan your Azure AD B2C tenants and discover:

• All App Registrations in the B2C tenant
• Secrets and certificates with expiry dates
• Credentials that are expired or expiring soon

Understanding B2C vs Regular Azure AD¶

CertifyClouds B2C Tenant Registry scans the App Registrations in your B2C tenant to monitor credential expiry for your customer-facing applications.

Prerequisites¶

Before configuring B2C Tenant Registry:

1. PRO tier license
2. Azure AD B2C tenant to monitor
3. Admin access to create service principal
4. Microsoft Graph permissions - Ability to grant admin consent

Required Information¶

Setup Steps¶

Step 1: Access Your B2C Tenant¶

1. Go to Azure Portal (portal.azure.com)
2. Click your profile icon → Switch directory
3. Select your Azure AD B2C tenant
4. Verify you see "Azure AD B2C" in the top-left

Step 2: Create Service Principal¶

1. Navigate to Azure AD B2C → App registrations
2. Click + New registration
3. Configure:

1. Click Register
2. Copy the Application (client) ID

Step 3: Create Client Secret¶

1. Go to Certificates & secrets
2. Click + New client secret
3. Configure:

1. Click Add
2. Copy the secret Value immediately

Step 4: Grant API Permissions¶

1. Go to API permissions
2. Click + Add a permission
3. Select Microsoft Graph → Application permissions
4. Add permissions:

!!! tip "Least Privilege" For discovery-only, Application.Read.All is sufficient. Add ReadWrite.All only if you want CertifyClouds to rotate B2C credentials.

1. Click Grant admin consent for [Your B2C Tenant]
2. Verify green checkmarks appear

CertifyClouds Configuration¶

Step 1: Add B2C Tenant¶

1. Go to Settings → B2C Tenant Registry
2. Click Add B2C Tenant

Step 2: Enter Details¶

Step 3: Configure Discovery¶

Step 4: Test and Register¶

1. Click Test Connection
2. Expected: "Connection successful - Found organization: [Tenant Name]"
3. Click Register Tenant

Step 5: Run Discovery¶

1. Click Discover on your tenant
2. View discovered credentials in the expanded view

What Gets Discovered¶

For each App Registration in your B2C tenant:

Rotating B2C Credentials¶

With Application.ReadWrite.All granted to the scanner service principal, CertifyClouds can rotate a B2C app's client secret or certificate directly from the UI, with the same confirm-and-progress flow as corporate App Registration rotation.

How It Works¶

1. Enable rotation for the app and acknowledge its matched Key Vault targets (the corporate-tenant Key Vault entries that store the credential)
2. Start the rotation - a confirmation dialog summarises what will change, then a progress modal streams each step in real time
3. A new credential is created on the B2C app
4. The new value is written to every acknowledged Key Vault target
5. The old credential stays valid for the configured grace window, then is removed automatically - cleanup runs against the B2C tenant using that tenant's own service principal
6. The run appears in Automation → Rotation → History alongside corporate rotations, with a tenant badge

Scanner Secret Self-Rotation¶

The per-tenant scanner service principal can rotate its own client secret:

• Auto-rotate before expiry - opt-in per tenant
• Rotate now - rotate immediately from the tenant card

Each rotation mints a new secret, verifies it with a real Microsoft Graph token acquisition, persists it, and only then retires the old one. See Rotating CertifyClouds' Own Credentials.

Configuring Alerts¶

Set up notifications for B2C credential expiry:

1. Go to Settings → Alerts
2. Create an Expiry rule with Source = B2C credentials (PRO)
3. Set the threshold (days before expiry)
4. Configure notification channels

A single Expiry rule scoped to B2C covers both expiring and already-expired credentials. See Alerts for the full rule model.

Troubleshooting¶

Common Issues¶

Verify Permissions¶

# Test Graph API access
az login --tenant YOUR_B2C_TENANT_ID
az ad app list --query "[].{name:displayName, appId:appId}" -o table

Security Best Practices¶

1. Least privilege - Use Application.Read.All for discovery-only
2. Rotate secrets - Renew the scanner service principal secret before expiry, or let CertifyClouds handle it via self-rotation
3. Monitor access - Review Azure AD sign-in logs
4. Separate environments - Use different scanner apps per environment