Azure AD B2C - Reject Passwords with name, surname, username

Question

I would like to know if it's possible in Azure AB B2C to reject passwords that contain the user's first name, last name, given name, username and possibly dictionary words. I have followed and implemented the instructions for setting up a custom password validator in the policy https://learn.microsoft.com/en-us/azure/active-directory-b2c/password-complexity?pivots=b2c-custom-policy.

Answer 1

Not natively supported by the B2C tenant configuration or policy configuration but it is possible using a ValidationTechnicalProfile and a custom REST API.

        <TechnicalProfile Id="LocalAccountSignUpWithLogonEmail">
          <DisplayName>Email signup</DisplayName>
          ...
          <OutputClaims>
            <!-- claims to be collected from the user -->
            ...

          </OutputClaims>
          <ValidationTechnicalProfiles>
            <ValidationTechnicalProfile ReferenceId="REST-ValidatePassword" />
            <ValidationTechnicalProfile ReferenceId="AAD-UserWriteUsingLogonEmail" />
          </ValidationTechnicalProfiles>
          <UseTechnicalProfileForSessionManagement ReferenceId="SM-AAD" />
        </TechnicalProfile>

        <TechnicalProfile Id="REST-ValidatePassword">
          <DisplayName>Validate user input data and return loyaltyNumber claim</DisplayName>
          <Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.RestfulProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
          <Metadata>
            <Item Key="ServiceUrl">https://your-app.azurewebsites.net/api/ValidatePassword</Item>
            <Item Key="AuthenticationType">None</Item>
            <Item Key="AllowInsecureAuthInProduction">true</Item>
            <Item Key="SendClaimsIn">Body</Item>
          </Metadata>
          <InputClaims>
            <InputClaim ClaimTypeReferenceId="signInName" />
            <InputClaim ClaimTypeReferenceId="newPassword" PartnerClaimType="password" />
            <InputClaim ClaimTypeReferenceId="givenName" />
            <InputClaim ClaimTypeReferenceId="surName" />
          </InputClaims>
          <UseTechnicalProfileForSessionManagement ReferenceId="SM-Noop" />
        </TechnicalProfile>

Your API then does the custom password checks such as

if (request.Password.Contains(request.givenName, StringComparison.OrdinalIgnoreCase)) 
      return {{ b2c 409 response }};

See REST API validation error response message