title: Secure API with Azure AD/B2C users
body: <p>My use case is:</p>
  
  <ul>
  <li>Create users via API with custom fields, nominated password using any email address</li>
  <li>Update/disable those users via API </li>
  <li>'Sign in' to Azure AD app with user details via rest API to obtain token</li>
  <li>Make authorised requests to Web API when token passed in Http header</li>
  </ul>
  
  <p>Can all of this be achieved with straight Azure AD/B2C or should I be looking at some other identity provider e.g. IdentityServer/Auth0?</p>
  
  <p><strong>Edit 1</strong></p>
  
  <p>I'm getting very confused between AAD apps/users and B2C apps/users, there is very little guidance on what to use in this case.</p>
  
  <p>Using <a href="https://docs.microsoft.com/en-us/azure/active-directory-b2c/active-directory-b2c-devquickstarts-graph-dotnet" rel="noreferrer">https://docs.microsoft.com/en-us/azure/active-directory-b2c/active-directory-b2c-devquickstarts-graph-dotnet</a> as a starting point I get the following results when plugging in the client id and secret from:</p>
  
  <ul>
  <li>Azure AD - Application Type Web app/ Api - works, can create user</li>
  <li>Azure AD - Application Type Native - does not work, cannot create user</li>
  <li>Azure B2C - Application created in Powershell as per link - works, can create user, however I can't see the newly created application in the Azure Portal, and can't make changes.</li>
  <li>Azure B2C - Application created in B2C UI - does not work, request to Graph Api fails with 'insufficient permissions'. I added the read/write permissions manually in Powershell but this did not work.</li>
  </ul>
  
  <p>At this point I don't know what is the correct approach for my scenario.</p>