The Solution
The Arco application is registered in Arco’s Azure AD. An Azure AD B2C service was provisioned as the new identity provider. The directory was populated using a snapshot of data found in the legacy identity provider with custom attributes to hold information such as account groups.
Azure Front Door was deployed to customise the authentication page domain. In this way, the sign-up, sign-in, and password reset pages are seamlessly integrated with the application and the browser address remains consistent.
Integration with the legacy identity provider was developed to streamline the switch for existing users. Existing users were not required to set a new password, and silent, “just-in-time” credential migration was achieved. For new users, the system requires email verification for identification.
Custom Policies enforce the setup and triggering of Multi-Factor Authentication on a user-by-user basis, as configured and shared by Arco. All MFA verification methods are supported.
Azure AD B2C Sign-in and auditing logs were routed to Azure Monitor in the linked Azure AD tenant. Azure Lighthouse was leveraged to connect the cross-tenant resources.