I am working on an app using B2C custom policies. Currently, I am replacing an extension attribute containing users’ phone numbers with Microsoft’s built-in Mobile phone attribute. In connection with this, I have tried using the claims transformation ConvertStringToPhoneNumberClaim (https://learn.microsoft.com/en-us/azure/active-directory-b2c/phone-number-claims-transformations#convertstringtophonenumberclaim), which takes two strings (representing the phone number and the country code) and validates the phone number. If the phone number is invalid, it’s supposed to return an error message, and if it’s valid, it returns the number in a valid format with the phoneNumber datatype.

This process worked well a couple of weeks ago. For example, if I tried registering with +47111 as the phone number, I would get an error, since 111 is an invalid Norwegian number. However, if I register with that number now, the registration is completed, and the user can be found in the B2C tenant with +47111 as their phone number.

The relevant parts of the TrustFrameworkExtensions.xml file are pasted in below.

The mobile claim is defined as follows:

<ClaimType Id="mobile">
  <DisplayName>Mobile Phone</DisplayName>
  <DataType>phoneNumber</DataType>
</ClaimType>

The claims transformation itself is exactly as in Microsoft’s documentation (linked above).

<ClaimsTransformation Id="ConvertStringToPhoneNumber" TransformationMethod="ConvertStringToPhoneNumberClaim">
  <InputClaims>
    <InputClaim ClaimTypeReferenceId="phoneString" TransformationClaimType="phoneNumberString"/>
    <InputClaim ClaimTypeReferenceId="countryCode" TransformationClaimType="country"/>
  </InputClaims>
  <OutputClaims>
    <OutputClaim ClaimTypeReferenceId="mobile" TransformationClaimType="outputClaim"/>
  </OutputClaims>
</ClaimsTransformation>

The technical profile that calls the claims transformation looks like this:

<TechnicalProfile Id="ConvertPhoneNumber">
  <DisplayName>Convert phone number</DisplayName>
  <Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.ClaimsTransformationProtocolProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null"/>
  <OutputClaims>
    <OutputClaim ClaimTypeReferenceId="mobile"/>
  </OutputClaims>
  <OutputClaimsTransformations>
    <OutputClaimsTransformation ReferenceId="ConvertStringToPhoneNumber"/>
  </OutputClaimsTransformations>
  <UseTechnicalProfileForSessionManagement ReferenceId="SM-Noop"/>
</TechnicalProfile>

The technical profile above is used as a validation technical profile in the technical profile below:

<TechnicalProfile Id="LocalAccountSignUpWithLogonEmail">
  <OutputClaims>
    <OutputClaim ClaimTypeReferenceId="givenName" Required="true" />
    <OutputClaim ClaimTypeReferenceId="surName" Required="true" />
    <OutputClaim ClaimTypeReferenceId="email" PartnerClaimType="Verified.Email" Required="true" />
    <OutputClaim ClaimTypeReferenceId="countryCode" Required="false" />
    <OutputClaim ClaimTypeReferenceId="phoneString" Required="false" />
    <OutputClaim ClaimTypeReferenceId="AffiliatedOrg" Required="false" />
    <OutputClaim ClaimTypeReferenceId="AffiliatedOrgContact" Required="false" />
    <OutputClaim ClaimTypeReferenceId="newPassword" Required="true" />
    <OutputClaim ClaimTypeReferenceId="reenterPassword" Required="true" />
    <OutputClaim ClaimTypeReferenceId="userPrincipalName" />
  </OutputClaims>
  <ValidationTechnicalProfiles>
    <ValidationTechnicalProfile ReferenceId="ConvertPhoneNumber" ContinueOnError="false">
      <Preconditions>
        <Precondition Type="ClaimsExist" ExecuteActionsIf="false">
          <Value>phoneString</Value>
          <Action>SkipThisValidationTechnicalProfile</Action>
        </Precondition>
      </Preconditions>
    </ValidationTechnicalProfile>
    <ValidationTechnicalProfile ReferenceId="AAD-UserWriteUsingLogonEmail" />
    <ValidationTechnicalProfile ReferenceId="SendNewUserToCrm" />
  </ValidationTechnicalProfiles>
</TechnicalProfile>

Finally, the corresponding technical profile in TrustFrameworkBase.xml looks like this:

<TechnicalProfile Id="LocalAccountSignUpWithLogonEmail">
  <DisplayName>Email signup</DisplayName>
  <Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.SelfAssertedAttributeProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
  <Metadata>
    <Item Key="IpAddressClaimReferenceId">IpAddress</Item>
    <Item Key="ContentDefinitionReferenceId">api.localaccountsignup</Item>
  </Metadata>
  <CryptographicKeys>
    <Key Id="issuer_secret" StorageReferenceId="B2C_1A_TokenSigningKeyContainer" />
  </CryptographicKeys>
  <InputClaims>
    <InputClaim ClaimTypeReferenceId="email" />
  </InputClaims>
  <OutputClaims>
    <OutputClaim ClaimTypeReferenceId="objectId" />
    <OutputClaim ClaimTypeReferenceId="email" PartnerClaimType="Verified.Email" Required="true" />
    <OutputClaim ClaimTypeReferenceId="newPassword" Required="true" />
    <OutputClaim ClaimTypeReferenceId="reenterPassword" Required="true" />
    <OutputClaim ClaimTypeReferenceId="executed-SelfAsserted-Input" DefaultValue="true" />
    <OutputClaim ClaimTypeReferenceId="authenticationSource" />
    <OutputClaim ClaimTypeReferenceId="newUser" />
    <OutputClaim ClaimTypeReferenceId="givenName" />
    <OutputClaim ClaimTypeReferenceId="surName" />
  </OutputClaims>
  <UseTechnicalProfileForSessionManagement ReferenceId="SM-AAD" />
</TechnicalProfile>

The only part of the code that’s different from when the validation worked is that I removed all validation technical profiles from LocalAccountSignUpWithLogonEmail in TrustFrameworkBase.xml and put them in the corresponding technical profile in TrustFrameworkExtensions.xml. This was done because the validation technical profiles were executed in the wrong order. Why doesn’t the phone number validation work anymore?