I’m working on an ASP.NET Core 8 API called ApiApp secured with Azure AD B2C and an ASP.NET Core MVC application called WebApp. Everything works fine, and I can call ApiApp from WebApp.

I want to enrich the user’s claims using IClaimsTransformation upon login. My goal is to implement IClaimsTransformation, make a call to ApiApp to query the database, retrieve the necessary data, and enrich the user’s claims.

To achieve this, I need a token to call ApiApp. I tried generating the token with the following method:

private async Task<string> GetApplicationTokenAsync()
{
    try
    {
        var clientId = _configuration["AzureAdB2C:ClientId"];
        var clientSecret = _configuration["AzureAdB2C:ClientSecret"];
        var scope = _configuration["MyApp:MyAppScope"];
        var tenant = _configuration["AzureAdB2C:Domain"];
        var policy = _configuration["AzureAdB2C:SignUpSignInPolicyId"];

        var authority = $"https://{tenant}.b2clogin.com/{tenant}.onmicrosoft.com/{policy}";

        var app = ConfidentialClientApplicationBuilder.Create(clientId)
            .WithClientSecret(clientSecret)
            .WithAuthority(new Uri(authority))
            .Build();

        var authResult = await app.AcquireTokenForClient(new[] { scope }).ExecuteAsync();
        return authResult.AccessToken;
    }
    catch (Exception ex)
    {
        throw;
    }
}

However, I receive the error:

AADSTS50049: “Unknown or invalid instance”.

• What should I do to correctly obtain the token?
• Is there something wrong in my Azure AD B2C configuration or code?