AD B2C forceChangePasswordNextLogin for user flow "Sign in v2" doesn't initiate a password reset and prevents a successful login
Rather than setting passwordProfile.forceChangePasswordNextLogin to true
, you can create a custom attribute (e.g. ForceResetPasswordNextLogin), set this to true
when you create the local account, and then issue this as an application claim from the sign-in policy to your B2C application. After sign-in, if it is set to true
, then your B2C application can initiate the password reset policy. After password reset, then your B2C application can set it to false
.
You can otherwise consider a custom policy from the starter pack that includes a password change step.