Scenario
We have an app that will be used by schools. Each school has an Azure AD instance that contains their staff and student users. These users have access to Office/Teams etc. through their school licenses. We also need to support parents having accounts and logging in.
For the parent accounts we would need to use something like B2C to allow them to create "local accounts" or sign up with their own Microsoft/Google/Facebook Accounts.
For student and staff accounts we would like to allow them to sign in with their AAD accounts.
My understanding is that this can be enabled with AADB2C by adding AAD as an identity provider within the B2C configuration. B2C also supports "IDP pass through" which allows you to get the access_token of the third party IDP being used.
My question is can this functionality (or indeed AADB2C at all) be used to get an access token that would allow you to access the signed in users MSGraph API (for whichever school it relates to)?
If not would that mean having to set up a B2C directory for the parent accounts and manage these completely separately from the AAD accounts that the school are managing for students and staff?
I've done a lot of reading and honestly, the more I read, the more confused I get xD