AAD B2C - Is a user authorized to change their own custom attributes?

user_13578422 0
Viewed 158

I want to use custom attributes in AAD B2C as a shortcut for authorization. I would love to set values on users that I can use in my apis to know what they have access to do.

I see that I can create a User flow for a user to edit their own attributes, but that is the opposite of what I want.

If I don't create a user flow to edit the attribute, can I be confident that the user can't edit it on their own through Microsoft Graph or something like that? I tried doing it through graph but I can't tell if I did something wrong or if the user is not allowed to change it.

azure-ad-b2c
2 Answers

It is better not to depend on User attributes for authorization. As user profile information (user attributes)can be managed by the user self or organization level.

user_129767040

I don't think users can adjust their own attributes if they don't have the graph permissions in Azure. When signing in your users within your application you can allow them to access certain scopes. As long as they cant access these scopes they cannot perform any actions on the graph API. Updating user details would in this case require 'User.ReadWrite' scope assigned.

user_96698690
Related