This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(275.2, 15%, 36%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ENB%3C/text%3E%3C/svg%3E)
I have an Azure B2C tenant where some users are being set to disabled for reasons I cannot determine. We have no custom policies or "access reviews". We have no custom code or scripts running. The users are just somehow being set to disabled in Azure B2C by the system. Most of these users are using third party identity providers, so it's not that they are getting locked out for too many bad password attempts. I can't find anything in the logs, and I'm not sure where to look.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(51.2, 82%, 14%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EVD%3C/text%3E%3C/svg%3E)
Hello Nathan Bell
Greetings!
As you can see in audit logs is there any changes has been made to the users in last 30 days.
Hope this helps. Do let us know if you have any further queries
And also I would like to check this up offline with you to understand the scenario better. Please share your contact details over private message and your availability for a call.
Hello Nathan Bell
Greetings!
I have shared the meeting invite in teams tomorrow 12:00PM CST.
Thank you.
Hello Nathan Bell
Just checking in to see if above information was helpful. If you have any further updates on this issue, please feel free to post back
Hello Nathan Bell
I have sent you an email regarding my finding.
I hope this information helps to you and let me know if you have any further questions, we will be happy to help you.
Hello Nathan Bell
We apologize for the delay. We are currently investigating the root cause of the issue and consulting with experts to determine why users' statuses are shown as disabled when they log in with social accounts to the B2C application.
We appreciate your patience.
Hello Nathan Bell
It’s because those are always disabled, and the check is skipped since that check occurs when B2C checks the backend for creds.
Use this sample https://github.com/azure-ad-b2c/samples/tree/master/policies/disable-social-account-from-logon
I don't understand your response. It is because what is disabled? Do you mean user accounts? Why are they disabled? What setting is causing them to be disabled? When we went through the settings via screenshare the other day you were unable to find a setting that produced this outcome. Have you found it now? What is it? What does that sample script have to do with my tenant? As we already established, I am not using any custom scripts.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(41.6, 77%, 14%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ER%3C/text%3E%3C/svg%3E)
@Nathan Bell, We will check this internally and get back to you shortly.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(6.4, 5%, 10%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ES%3C/text%3E%3C/svg%3E)
Hello Nathan Bell,
Apologies for the delayed response and thank you for your patience.
After reviewing your Azure AD B2C setup, we noticed that you're using a custom policy, and the users being marked as disabled are those signing in with third-party identity providers such as Google, Facebook, Microsoft, or Apple.
This occurs because B2C creates these federated accounts without a local password, and by default, such accounts are automatically marked as disabled. This behavior is designed to prevent password-less accounts from being used for local sign-ins. Even if the policy attempts to enable the account, B2C overrides that setting at the time of creation.
This is a known and expected behavior, as confirmed in the following Microsoft Q&A threads:
If you want these users to show as enabled and be able to use your app, you have a couple of options. You can add a step in your policy after the account is created to update the user and enable the account. Or, if you're just using this status inside your app, you can create a custom attribute to track if the user is active.
Hope this helps clear things up.
Kindly consider upvoting this comment if the information was helpful, as it may assist others facing a similar issue.
If you have any further questions, feel free to reach out!
Hello Nathan Bell,
Did you get a chance to see my previous comment, let me know if I can be of help to you. If you have any further query do let us know
How do you accomplish this "You can add a step in your policy after the account is created to update the user and enable the account". Are there step by step instructions somewhere?