> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.id.me/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.id.me/_mcp/server.

# Azure

> Configure ID.me on Azure

This guide walks you through configuring ID.me as an identity provider on the Azure Active Directory B2C (Azure AD B2C) platform.

> **Important**
>
> Microsoft has announced that "Effective May 1, 2025, Azure AD B2C will no longer be available to purchase for new customers."
>
> Read more in Microsoft's [official announcement.](https://learn.microsoft.com/en-us/azure/active-directory-b2c/faq?tabs=app-reg-ga#azure-ad-b2c-end-of-sale)

## Prerequisites

Before you begin:

* You need an [ID.me Developer Account](https://developers.id.me/registration/new)
* You must have admin access to your Azure AD B2C tenant

## Create an ID.me application

Sign in to [ID.me Developer Resources](https://api.id.me/en/session/new)

Select **View My Applications**, then select **Continue**

Select **Create new** and provide the following:

* *Name* and *Display Name*
* *Redirect URI*:
  * `https://your-tenant-name.b2clogin.com/your-tenant-name.onmicrosoft.com/oauth2/authresp`
  * Or if using a custom domain: `https://your-domain-name/your-tenant-name.onmicrosoft.com/oauth2/authresp`
* Replace placeholders accordingly

Select **Continue**

Note the *Client ID* and *Client Secret*, as you will need both for Azure AD B2C configuration

## Create a policy key in Azure

Sign in to the [Azure portal](https://portal.azure.com/)

Switch to the correct directory if needed

Select **All services** > **Azure AD B2C** > **Identity Experience Framework**

Select **Policy Keys** > **Add**

For *Options*, select **Manual**

Enter a *Name* (e.g., `IdMeSecret`). Azure will add the prefix `B2C_1A_`

Enter your *Client Secret*

Set *Key usage* to **Signature**

Select **Create**

## Configure ID.me as an identity provider

Open your `TrustFrameworkExtensions.xml` file

Inside the `<ClaimsProviders>` element, add:

```xml
<ClaimsProvider>
  <Domain>id.me</Domain>
  <DisplayName>ID.me</DisplayName>
  <TechnicalProfiles>
    <TechnicalProfile Id="IdMe-OAuth2">
      <DisplayName>IdMe</DisplayName>
      <Protocol Name="OAuth2" />
      <Metadata>
        <Item Key="ProviderName">api.id.me</Item>
        <Item Key="authorization_endpoint">https://api.id.me/oauth/authorize</Item>
        <Item Key="AccessTokenEndpoint">https://api.id.me/oauth/token</Item>
        <Item Key="ClaimsEndpoint">https://api.id.me/api/public/v2/attributes.json</Item>
        <Item Key="HttpBinding">POST</Item>
        <Item Key="scope">openid alumni</Item>
        <Item Key="UsePolicyInRedirectUri">0</Item>
        <!-- Update the Client ID below to the Application ID -->
        <Item Key="client_id">Your ID.me application ID</Item>
      </Metadata>
      <CryptographicKeys>
        <Key Id="client_secret" StorageReferenceId="B2C_1A_IdMeSecret"/>
      </CryptographicKeys>
      <OutputClaims>
        <OutputClaim ClaimTypeReferenceId="issuerUserId" PartnerClaimType="uuid" />
        <OutputClaim ClaimTypeReferenceId="givenName" PartnerClaimType="fname" />
        <OutputClaim ClaimTypeReferenceId="surname" PartnerClaimType="lname" />
        <OutputClaim ClaimTypeReferenceId="displayName" PartnerClaimType="name" />
        <OutputClaim ClaimTypeReferenceId="email" PartnerClaimType="email" />
        <OutputClaim ClaimTypeReferenceId="identityProvider" DefaultValue="me.id.com" AlwaysUseDefaultValue="true" />
        <OutputClaim ClaimTypeReferenceId="authenticationSource" DefaultValue="socialIdpAuthentication" AlwaysUseDefaultValue="true" />
      </OutputClaims>
      <OutputClaimsTransformations>
        <OutputClaimsTransformation ReferenceId="CreateRandomUPNUserName" />
        <OutputClaimsTransformation ReferenceId="CreateUserPrincipalName" />
        <OutputClaimsTransformation ReferenceId="CreateAlternativeSecurityId" />
        <OutputClaimsTransformation ReferenceId="CreateDisplayNameFromFirstNameAndLastName" />
      </OutputClaimsTransformations>
      <UseTechnicalProfileForSessionManagement ReferenceId="SM-SocialLogin" />
    </TechnicalProfile>
  </TechnicalProfiles>
</ClaimsProvider>
```

Replace `client_id` with your actual ID.me application ID, then save the file

## Add claims transformations

Inside `<BuildingBlocks>`, within the `<ClaimsTransformations>` element, add:

```xml
<BuildingBlocks>
  <ClaimsTransformations>
    <ClaimsTransformation Id="CreateDisplayNameFromFirstNameAndLastName" TransformationMethod="FormatStringMultipleClaims">
      <InputClaims>
        <InputClaim ClaimTypeReferenceId="givenName" TransformationClaimType="inputClaim1" />
        <InputClaim ClaimTypeReferenceId="surName" TransformationClaimType="inputClaim2" />
      </InputClaims>
      <InputParameters>
        <InputParameter Id="stringFormat" DataType="string" Value="{0} {1}" />
      </InputParameters>
      <OutputClaims>
        <OutputClaim ClaimTypeReferenceId="displayName" TransformationClaimType="outputClaim" />
      </OutputClaims>
    </ClaimsTransformation>
  </ClaimsTransformations>
</BuildingBlocks>
```

## Add to orchestration steps

Insert the following where orchestration logic is defined:

```xml
<OrchestrationStep Order="1" Type="CombinedSignInAndSignUp" ContentDefinitionReferenceId="api.signuporsignin">
  <ClaimsProviderSelections>
    <ClaimsProviderSelection TargetClaimsExchangeId="IdMeExchange" />
  </ClaimsProviderSelections>
</OrchestrationStep>
<OrchestrationStep Order="2" Type="ClaimsExchange">
  <ClaimsExchanges>
    <ClaimsExchange Id="IdMeExchange" TechnicalProfileReferenceId="IdMe-OAuth2" />
  </ClaimsExchanges>
</OrchestrationStep>
```

## Test your custom policy

Select your relying party policy (e.g., `B2C_1A_signup_signin`)

Choose a web app you've previously registered. The reply URL should be `https://jwt.ms`.

Select **Run now**

From the sign-in page, select **ID.me** to test the integration

> If the sign-in is successful, you will be redirected to `https://jwt.ms`, where the token details will be displayed.