Azure B2C + Drupal identity integration
Enterprise identity is the hardest invisible thing a platform has to do. Azure B2C terminates at the CISO’s desk — FIDO2, Conditional Access, multi-tenant guest identities, and the compliance posture that comes with an Entra-family product. The problem begins where Drupal meets it: OpenID Connect against B2C is well-documented, but user lifecycle is not. Accounts drift, role claims go stale, offboarded employees retain session-scoped access, and “authenticated” quietly diverges from “authorized.”
My work here spans custom OpenID Connect client modules against B2C user flows and custom policies, claims-to-role mapping with deterministic precedence, JIT provisioning, and SCIM 2.0 endpoints exposed from Drupal so Entra can push the source-of-truth directory at us rather than the other way around. The result is a Drupal site where authorization reflects the IdP within minutes of a change, with audit trails that survive a compliance walkthrough.