Using Azure AD Graph API to create a User in Azure AD B2C

Question

My application was designed to add a user to my Azure AD B2C using Azure AD Graph API. I also handled the case where I'd be calling the add user graph API with an email ID that already exists in AD. I was looking for the error message in the response body to handle this. Has there been any change w.r.t the response message?

POST
https://graph.windows.net/{tenant}/users?api-version=1.6

Request Body :

{
  "accountEnabled": true,
  "signInNames": [
    {
        "type": "EmailAddress",
        "value": "TestGraphApiCreatedUser@TestGraphApiCreatedUser.com"
    }],
  "displayName": "TestGraphApiCreatedUser",
  "mailNickname": "TestGraphApiCreatedUser",
  "passwordProfile" : {
    "forceChangePasswordNextLogin": false,
    "password": "vhkjds#fceu456VCHU"
  },
  "creationType": "LocalAccount",
  "passwordPolicies": "DisablePasswordExpiration"
}

If a user already exists with the given email address, the error I was getting earlier was

{
    "odata.error": {
        "code": "Request_BadRequest",
        "message": {
            "lang": "en",
            "value": "Another object with the same value for property signInName already exists."
        }
    }
}

Now, for the same flow, I'm getting below error :

{
    "odata.error": {
        "code": "Request_BadRequest",
        "message": {
            "lang": "en",
            "value": "Another object with the same value for property userPrincipalName already exists."
        }
    }
}

Is there any difference between the two error messages. Since there isn't any error code, I had hard coded the whole error message. Now that there is a slight change in the message, I've to update my code. How can I handle this in a better way?

user_8883024 · Answer

I didn't check to confirm if they changed the error message, but it wouldn't surprise me at all if they did. The userPrincipalName may be coming from the underlying AAD, maybe MS changed the B2C implementation and now it exposes an error message from there?

In your particular case, a better option may be to check if the email address exists in B2C just before calling the API to create the new user. It's an extra API call, but it shouldn't matter much unless you're creating many users at a time, e.g. in a batch. You'll still have to handle the user creation call failure, but if it happens you could just return a generic error message.

Using Azure AD Graph API to create a User in Azure AD B2C

1 Answers