We have implemented an Azure backend that exposes a Web API and uses Azure AD B2C to authenticate users. These APIs are consumed by a web portal that is built using a low code platform. When a user navigates to the web portal he is first redirected to Azure AD B2C to login with username/password plus MFA. Upon successful login the user receives a JWT token which is passed in an authorization header to API calls. The API verifies the token and returns data to the portal. A token is valid for one hour and once expired the user has to login again with username/password and MFA.

We are now investigating if we can make the portal available as PWA. The main idea behind this is that we can offer the user an app and use Face ID (or an alternative depending on OS) to make the login process more convenient. The scenario we have in mind is that the user needs to login only the first time with username/password + MFA, and then enable Face ID (or alternative depending on OS) for future logins. So for future logins the user no longer needs to enter username/password + MFA, but this replaced by Face ID.

I am trying to get my head around how integration with Face ID could work in relation to Azure AD B2C. Our backend APIs only work with an Azure AD B2C token, so I expect the PWA still needs to request a token from Azure AD B2C, but what is the role of Face ID in this flow? Do we need to create a separate custom policy in Azure AD B2C in which we can somehow verify Face ID?

Has anyone experience with such flow? Any help or pointers to relevant documentation or diagrams are highly appreciated.