Azure AD B2C不支持客户端凭证流，有无可行替代方案？

Hey there! Let's break down your question to figure out the right approach for your scenario.

核心前提：Azure AD B2C不支持服务对服务的客户端凭证流 #

As you already noted, Azure AD B2C does not natively support the client credentials grant flow—this is a critical limitation here because your use case is a service-to-service interaction (external server app → your internal API), which relies on this flow for secure, user-less authentication. B2C is built primarily for customer-facing end-user authentication (like sign-up/sign-in flows for individual users), not for server-to-server communication.

为什么Azure AD B2B是正确选择？ #

Azure AD B2B is purpose-built for collaborating with external organizations, including enabling their server applications to access your internal resources. Here's how it fits your needs:

• You can register the external organization's server application as a service principal in your Azure AD tenant, or invite their existing app as a guest entity.
• Configure your internal API to expose specific permissions, then grant those permissions to the external app.
• The external server app can then use the client_credentials flow to request an access token from your Azure AD tenant, and use that token to authenticate against your API securely.

关于B2C的替代方案（不推荐） #

If you tried to force this scenario with B2C, you'd have to hack together workarounds—like using a user flow with a hardcoded service account. This is a poor practice because it introduces unnecessary security risks (storing user credentials in a server app) and doesn't align with service-to-service authentication best practices.

总结 #

For your use case of an external server application accessing your internal API, Azure AD B2B is the appropriate and secure solution. Azure AD B2C can't natively support the required client credentials flow for this type of service-to-service interaction.

内容的提问来源于stack exchange，提问作者srini