Supported Applications

Azure

This guide walks you through configuring ID.me as an identity provider on the Azure Active Directory B2C (Azure AD B2C) platform.

Important

Microsoft has announced that “Effective May 1, 2025, Azure AD B2C will no longer be available to purchase for new customers.”

Read more in Microsoft’s official announcement.

Prerequisites

Before you begin:

Create an ID.me application

2

Select View My Applications, then select Continue

3

Select Create new and provide the following:

  • Name and Display Name
  • Redirect URI:
    • https://your-tenant-name.b2clogin.com/your-tenant-name.onmicrosoft.com/oauth2/authresp
    • Or if using a custom domain: https://your-domain-name/your-tenant-name.onmicrosoft.com/oauth2/authresp
  • Replace placeholders accordingly
4

Select Continue

5

Note the Client ID and Client Secret, as you will need both for Azure AD B2C configuration

Create a policy key in Azure

1

Sign in to the Azure portal

2

Switch to the correct directory if needed

3

Select All services > Azure AD B2C > Identity Experience Framework

4

Select Policy Keys > Add

5

For Options, select Manual

6

Enter a Name (e.g., IdMeSecret). Azure will add the prefix B2C_1A_

7

Enter your Client Secret

8

Set Key usage to Signature

9

Select Create

Configure ID.me as an identity provider

1

Open your TrustFrameworkExtensions.xml file

2

Inside the <ClaimsProviders> element, add:

1<ClaimsProvider>
2  <Domain>id.me</Domain>
3  <DisplayName>ID.me</DisplayName>
4  <TechnicalProfiles>
5    <TechnicalProfile Id="IdMe-OAuth2">
6      <DisplayName>IdMe</DisplayName>
7      <Protocol Name="OAuth2" />
8      <Metadata>
9        <Item Key="ProviderName">api.id.me</Item>
10        <Item Key="authorization_endpoint">https://api.id.me/oauth/authorize</Item>
11        <Item Key="AccessTokenEndpoint">https://api.id.me/oauth/token</Item>
12        <Item Key="ClaimsEndpoint">https://api.id.me/api/public/v2/attributes.json</Item>
13        <Item Key="HttpBinding">POST</Item>
14        <Item Key="scope">openid alumni</Item>
15        <Item Key="UsePolicyInRedirectUri">0</Item>
16        <!-- Update the Client ID below to the Application ID -->
17        <Item Key="client_id">Your ID.me application ID</Item>
18      </Metadata>
19      <CryptographicKeys>
20        <Key Id="client_secret" StorageReferenceId="B2C_1A_IdMeSecret"/>
21      </CryptographicKeys>
22      <OutputClaims>
23        <OutputClaim ClaimTypeReferenceId="issuerUserId" PartnerClaimType="uuid" />
24        <OutputClaim ClaimTypeReferenceId="givenName" PartnerClaimType="fname" />
25        <OutputClaim ClaimTypeReferenceId="surname" PartnerClaimType="lname" />
26        <OutputClaim ClaimTypeReferenceId="displayName" PartnerClaimType="name" />
27        <OutputClaim ClaimTypeReferenceId="email" PartnerClaimType="email" />
28        <OutputClaim ClaimTypeReferenceId="identityProvider" DefaultValue="me.id.com" AlwaysUseDefaultValue="true" />
29        <OutputClaim ClaimTypeReferenceId="authenticationSource" DefaultValue="socialIdpAuthentication" AlwaysUseDefaultValue="true" />
30      </OutputClaims>
31      <OutputClaimsTransformations>
32        <OutputClaimsTransformation ReferenceId="CreateRandomUPNUserName" />
33        <OutputClaimsTransformation ReferenceId="CreateUserPrincipalName" />
34        <OutputClaimsTransformation ReferenceId="CreateAlternativeSecurityId" />
35        <OutputClaimsTransformation ReferenceId="CreateDisplayNameFromFirstNameAndLastName" />
36      </OutputClaimsTransformations>
37      <UseTechnicalProfileForSessionManagement ReferenceId="SM-SocialLogin" />
38    </TechnicalProfile>
39  </TechnicalProfiles>
40</ClaimsProvider>
3

Replace client_id with your actual ID.me application ID, then save the file

Add claims transformations

Inside <BuildingBlocks>, within the <ClaimsTransformations> element, add:

1<BuildingBlocks>
2  <ClaimsTransformations>
3    <ClaimsTransformation Id="CreateDisplayNameFromFirstNameAndLastName" TransformationMethod="FormatStringMultipleClaims">
4      <InputClaims>
5        <InputClaim ClaimTypeReferenceId="givenName" TransformationClaimType="inputClaim1" />
6        <InputClaim ClaimTypeReferenceId="surName" TransformationClaimType="inputClaim2" />
7      </InputClaims>
8      <InputParameters>
9        <InputParameter Id="stringFormat" DataType="string" Value="{0} {1}" />
10      </InputParameters>
11      <OutputClaims>
12        <OutputClaim ClaimTypeReferenceId="displayName" TransformationClaimType="outputClaim" />
13      </OutputClaims>
14    </ClaimsTransformation>
15  </ClaimsTransformations>
16</BuildingBlocks>

Add to orchestration steps

Insert the following where orchestration logic is defined:

1<OrchestrationStep Order="1" Type="CombinedSignInAndSignUp" ContentDefinitionReferenceId="api.signuporsignin">
2  <ClaimsProviderSelections>
3    <ClaimsProviderSelection TargetClaimsExchangeId="IdMeExchange" />
4  </ClaimsProviderSelections>
5</OrchestrationStep>
6<OrchestrationStep Order="2" Type="ClaimsExchange">
7  <ClaimsExchanges>
8    <ClaimsExchange Id="IdMeExchange" TechnicalProfileReferenceId="IdMe-OAuth2" />
9  </ClaimsExchanges>
10</OrchestrationStep>

Test your custom policy

1

Select your relying party policy (e.g., B2C_1A_signup_signin)

2

Choose a web app you’ve previously registered. The reply URL should be https://jwt.ms.

3

Select Run now

4

From the sign-in page, select ID.me to test the integration

If the sign-in is successful, you will be redirected to https://jwt.ms, where the token details will be displayed.