Implement Azure security →easyMultiple ChoiceObjective-mapped

AZ-204 Implement Azure security Practice Question

You are developing a web app that uses Azure AD B2C for customer identity. The app must allow users to sign in with their social media accounts like Facebook and Google. Which Azure AD B2C policy type should you configure?

⚠ Common exam trap

Candidates might mistakenly choose profile editing or password reset policies, which serve different purposes (post-authentication profile management and password recovery for local accounts, respectively) and are not designed for initial sign-up or sign-in with social identity providers. Conditional access policies are also not the correct mechanism for configuring identity providers in B2C. The key is to understand that the 'Sign-up and sign-in' user flow is specifically designed to integrate social identity providers for the primary authentication journey.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Sign-up and sign-in policy

The sign-up and sign-in policy (now called a user flow in the Azure portal) is the correct choice because it is the Azure AD B2C policy type specifically designed to handle both user registration and authentication in a single flow. This policy can be configured to include social identity providers like Facebook and Google, allowing users to sign in using those accounts. It orchestrates the OAuth 2.0 and OpenID Connect protocols to redirect users to the social provider's authorization endpoint and then process the returned tokens.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Profile editing policy
Why it's wrong here
An Azure AD B2C profile editing policy is specifically designed for users to manage and update their personal attributes, such as name or contact information, within their existing account. This policy is invoked after a user has already authenticated and does not facilitate the initial sign-up or sign-in process, nor does it integrate with social identity providers for authentication purposes. Therefore, it cannot enable sign-in with social providers.
✓
Sign-up and sign-in policy
Why this is correct
An Azure AD B2C sign-up and sign-in policy is the foundational user flow that orchestrates the entire user journey for both new user registration and existing user authentication. It is within this policy type that you configure and enable various identity providers, including social identity providers like Google or Facebook, allowing users to choose their preferred method for creating an account or signing into the application. This policy directly enables the required functionality for social sign-in.
✗
Password reset policy
Why it's wrong here
The Azure AD B2C password reset policy is a dedicated user flow designed exclusively for users who have forgotten their local account password. Its sole purpose is to guide users through a secure process to verify their identity and set a new password for their existing local account. This policy is distinct from the initial authentication flow and does not support or integrate with social identity providers for the purpose of signing in.
✗
Conditional access policy
Why it's wrong here
Conditional Access policies are a feature of Microsoft Entra ID (formerly Azure Active Directory) that enforce specific access controls based on various conditions, such as user location or device compliance, *after* a user has successfully authenticated. These policies operate post-authentication to determine resource access permissions and are not involved in the initial sign-in process itself or the integration with social identity providers for authentication.

Go deeper

AZ-204 Implement Azure security Practice Question

Why each option matters

Option-by-option breakdown

Related to this question