Azure B2C JIT迁移：如何写入已验证MFA邮箱及手机号至用户配置文件

要将遗留系统返回的已验证邮箱和手机号写入用户配置文件并直接用于MFA流程，需完成以下配置修改：

1. 传递输入声明 #

确保REST API返回的email和phone能传递到写入流程，在技术配置文件的InputClaims节点中添加对应声明：

<InputClaims>
    <InputClaim ClaimTypeReferenceId="signInName" PartnerClaimType="signInNames.userName" Required="true" />
    <InputClaim ClaimTypeReferenceId="email" Required="true" />
    <InputClaim ClaimTypeReferenceId="phone" Required="true" />
</InputClaims>

2. 持久化已验证凭证并标记状态 #

在PersistedClaims中添加邮箱和手机号的持久化配置，同时通过Metadata标记这两个凭证为已验证状态，让B2C认可其有效性，无需用户再次验证：

修改后的完整技术配置文件 #

<TechnicalProfile Id="AAD-UserWriteUsingLogonName">
    <Metadata>
        <Item Key="Operation">Write</Item>
        <Item Key="RaiseErrorIfClaimsPrincipalAlreadyExists">true</Item>
        <!-- 标记邮箱、手机号为已验证状态 -->
        <Item Key="EmailVerificationStatus">Verified</Item>
        <Item Key="PhoneVerificationStatus">Verified</Item>
    </Metadata>
    <InputClaims>
        <InputClaim ClaimTypeReferenceId="signInName" PartnerClaimType="signInNames.userName" Required="true" />
        <InputClaim ClaimTypeReferenceId="email" Required="true" />
        <InputClaim ClaimTypeReferenceId="phone" Required="true" />
    </InputClaims>
    <PersistedClaims>
        <PersistedClaim ClaimTypeReferenceId="signInName" PartnerClaimType="signInNames.userName" />
        <!-- 持久化已验证邮箱到MFA字段 -->
        <PersistedClaim ClaimTypeReferenceId="email" PartnerClaimType="strongAuthenticationEmailAddress" />
        <!-- 持久化已验证手机号到MFA字段 -->
        <PersistedClaim ClaimTypeReferenceId="phone" PartnerClaimType="strongAuthenticationPhoneNumber" />
        <PersistedClaim ClaimTypeReferenceId="newPassword" PartnerClaimType="password" />
        <PersistedClaim ClaimTypeReferenceId="displayName" DefaultValue="SomeDefaultDisplayNameValue" />
                        
        <!-- Optional claims. -->
        <PersistedClaim ClaimTypeReferenceId="givenName" />
        <PersistedClaim ClaimTypeReferenceId="surname" />
    </PersistedClaims>
    <OutputClaims>
        <OutputClaim ClaimTypeReferenceId="objectId" />
        <OutputClaim ClaimTypeReferenceId="newUser" PartnerClaimType="newClaimsPrincipalCreated" />
        <OutputClaim ClaimTypeReferenceId="authenticationSource" DefaultValue="localAccountAuthentication" />
        <OutputClaim ClaimTypeReferenceId="userPrincipalName" />
    </OutputClaims>
    <IncludeTechnicalProfile ReferenceId="AAD-Common" />
    <UseTechnicalProfileForSessionManagement ReferenceId="SM-AAD" />
</TechnicalProfile>

3. MFA流程适配 #

后续在MFA技术配置文件中，直接引用strongAuthenticationEmailAddress和strongAuthenticationPhoneNumber声明即可。由于这两个凭证已被标记为已验证，B2C会直接跳过验证步骤，允许用户选择对应的MFA方式。

内容的提问来源于stack exchange，提问作者Erkan Y.