I have an Azure B2C Tenant which displays some custom HTML, which it grabs from Power Portals. This all works well, the template gets rendered, and users are able to log in.

The problem is that if I set the portal to Private, then B2C is no longer able to access it. I get a CORS error:

Access to XMLHttpRequest at 'https://login.windows.net/fbef0798-20e3-4be7-bdc8-372032610f65/oauth2/authorize?client_id=[client]&redirect_uri=[redirect]%2f&response_type=code%20id_token&scope=openid%20profile&state=OpenIdConnect.AuthenticationProperties%3D6H3WXopJdru8Zo-FcILCyzVf1C6t6t-68aAjjcu8wCCFV_Yh9NXmtvUlXZ5LUL9_nejjT_Fm_5Rhlb8-RGWO70udRhOkZvB7Gp9qko-2BfnYgImwG-6CjdK9VW6Ku1puQNTrLk0O_SVudxefjihGdwlrnUUALm0e0EU9WMZMJKWSQ_ekECbANPijVo9Ag5aOop6FHFzlTN7kviFL1mK1TXj3okOp47uFeTImEdTEHaWrB31YOsOtujtQuXtw5sexR9Hyrys9OfvFBRmsuiMkx06EELsOclVsxjrsNxXxtHPoe4aaRNHxOG12VfQUiwyRKHqg6TVaxtJLzCTBxRven2AkGbEpY7wwafa2vNbh-0bniWRjrN5LOEzvHtaK64fo09LlFCB8kHgrvUmJRUedqP-RmFBkm9HF_8bYrZ3k3Ew&response_mode=form_post&nonce=638513965988554397.NTNhOWM0NzctYWM1Yy00ZGE1LWFkYjctNDg2MDMyNGNiNmM5MzIwNTYyNmMtMTJlNi00NGJlLTllNTgtZjE5MWJkZDY4MDg4&ui_locales=en-US&x-client-SKU=ID_NET472&x-client-ver=6.35.0.0' (redirected from 'https://[portal name].powerappsportals.com/en/azure-ad-b2c/signin/') from origin 'https://[b2c tenant name].b2clogin.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.

My user is authenticated against the portal and is able to connect to it (they’ve been added as a user there), but I believe because the URL changes once I get redirected into B2C, it’s no longer able to render the template. Then we run into this CORS error and end up with a blank screen.

One possible workaround I’ve thought of is to have two portals, one to be public that hosts the Template HTML, and a second that would be our actual portal. I don’t think that’s ideal, though, and it creates a lot of extra work for deployments.

So my hope is there might be some other way around this, where I can set B2C as a trusted domain. I haven’t been able to find any way of doing that though. Can someone point me towards some options around that?