title: Azure B2C IDP SAML for multiple service providers
body: <p>I have configured Azure B2C as IDP via SAML successfully for a single Service Provider. There are many pieces that i don't understand in this setup even though its working. 
  I will describe what i have so far and then ask questions later. </p>
  
  <p>Let's say I have two Service Providers,SP1/SP2 both require SAML and a page to signup/signin. SP1 requires loyality_id as custom attribute and SP2 requires product_name attribute. </p>
  
  <p>Here's the <a href="https://github.com/afroz429/b2c-saml/tree/master/custompolicies" rel="nofollow noreferrer">source code</a> that works.
  Credit/Thanks to this <a href="http://blogs.quovantis.com/saml-based-sso-with-azure-ad-b2c-as-an-idp/" rel="nofollow noreferrer">blog</a></p>
  
  <p>Below is the high level summary of the configuration.</p>
  
  <p>SAML for SP1 (Service Provider 1):</p>
  
  <ul>
  <li>Add signing and encryption keys to the B2C tenant</li>
  <li>Register Identity Experience Framework applications
  
  <ul>
  <li>Create web app IdentityExperienceFramework in Azure Active Directory</li>
  <li>Create native app ProxyIdentityExperienceFramework in Azure Active Directory</li>
  </ul></li>
  <li>Start from starter pack for LocalAccounts as base</li>
  <li>Add Saml2AssertionIssuer to the base policy</li>
  <li>Add user journey SignInSaml to the base policy</li>
  <li>In Extension Policy override "Local Account SignIn" claims provider and add substitute values for "client_id" and "IdTokenAudience" from apps that were created earlier</li>
  <li>Policy file with RelyingParty for SP1
  
  <ul>
  <li>This describes the output claims that are added to the SAML response</li>
  </ul></li>
  </ul>
  
  <p>Signup/signin policies for SP1:</p>
  
  <ul>
  <li>Create built-in signup and sigin policy</li>
  <li>Create Application in Azure B2C blade</li>
  </ul>
  
  <p>So far with this setup, I have two Applications in Azure Active Directory for custom policies and one Application in Azure B2C blade for built-in policy.</p>
  
  <p>According to <a href="https://docs.microsoft.com/en-us/azure/active-directory-b2c/active-directory-b2c-create-custom-attributes-profile-edit-custom" rel="nofollow noreferrer">https://docs.microsoft.com/en-us/azure/active-directory-b2c/active-directory-b2c-create-custom-attributes-profile-edit-custom</a>,</p>
  
  <blockquote>
    <p>Extension properties can only be registered on an Application object
    even though they may contain data for a User. The property is attached
    to the application.  The Application object must be granted write
    access to register an extension property.</p>
  </blockquote>
  
  <ul>
  <li>What is the "Application" the above paragraph is referring to?</li>
  <li>What is the purpose of the apps IdentityExperienceFramework/ProxyIdentityExperienceFramework</li>
  <li>To setup for SP2, do I need to create separate Azure Active directory apps for IdentityExperienceFramework/ProxyIdentityExperienceFramework? Or can I use the same ones? How do custom attributes factor in this?</li>
  <li>How do I setup custom attributes in this case where SAML is through Custom policy and Signin/Signup is builtin policy</li>
  <li>In this case, under what App context are the custom attributes created?</li>
  </ul>
  
  <p>I appreciate any pointers.</p>
  
  <p>Thanks</p>