The SSO protocol used is OpenID Connect (OIDC). OpenID Connect (OIDC) is an identity authentication protocol that is an extension of open authorization (OAuth) 2.0 to standardize the process for authenticating and authorizing users when they sign in to access digital services.

Documentation: https://learn.microsoft.com/en-us/azure/active-directory-b2c/openid-connect-technical-profile

In order to authenticate users, a new Application Registration is required in the client’s Azure AD.

At creation, accept the default selection of Accounts in this organizational directory only (Default Directory only - Single tenant) for this application. For connection the values of Application (client) ID and Directory (tenant) ID and Client Secret (created below) is needed.

Documentation, section Register a Microsoft Entra app: https://learn.microsoft.com/en-us/azure/active-directory-b2c/identity-provider-azure-ad-single-tenant?pivots=b2c-custom-policy#register-a-microsoft-entra-app

Give the app an easy identifiable name. Accept the default selection of Accounts in this organizational directory only (Default Directory only - Single tenant). Redirect URI may be left empty and completed later, or add the necessary ones from the Set app registration redirect URI step.

Here is the screen with the info of the just created application.

It is suggested to create separate client secrets per environment.

Add web redirect URI for the app in the Authentication settings. Please add the URLs only for necessary environments (usually production, preprod may be added for testing).

B2C is using ID tokens. Please make sure the ID tokens (used for implicit and hybrid flows) checkbox is checked in the Authentication settings.

The application requires the following permissions:

Once created, please share the following information to your customer success manager or technical account manager at Cimes.