title: Error 70001 trying to sign in as Azure AD B2C user with custom Identity Experience Framework policy
body: <p>We have a Web App secured with Azure AD B2C using custom Identity Experience Framework policies to allow users to register and sign in with social identities (Microsoft, Google, Facebook), or with an identity from another federated Azure AD instance, or with 'local' Email / Password accounts.</p>
  
  <p>All the social accounts and the Federated AD work correctly. Sign up and sign in with Email/Password was working correctly, but we are now experiencing an error. We haven't knowingly made any changes to our Email/Password configuration since this was last known to be working, so we're not sure how this has happened.</p>
  
  <p>The issue is: Sign Up with a new Email Address works correctly, and after the process completes, the user is correctly logged-in, and their account appears in the directory. If the user signs out, however, then any attempt to sign back in again fails:<a href="https://i.stack.imgur.com/9L4ii.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/9L4ii.png" alt="enter image description here"></a> </p>
  
  <p>(Email address shown is not the actual one. Error has been repeated by multiple users with new and old email/password combinations.)</p>
  
  <p>Digging into the portal, the underlying error is revealed as:</p>
  
  <blockquote>
    <p>70001 The application named X was not found in the tenant named Y. This can happen if the application has not been installed by the administrator of the tenant or consented to by any user in the tenant. You might have sent your authentication request to the wrong tenant.</p>
  </blockquote>
  
  <p>This error appears sometimes to be related to a failure to grant permissions to an application in the portal. We have tried removing and reinstating all permissions, and re-granting permissions. This has not solved the issue.</p>
  
  <p>Does anyone know what could be causing this issue, and in particular why sign up / sign in works correctly, but returning sign in does not?</p>
  
  <p><strong>UPDATE:</strong></p>
  
  <p>Just to confirm that we have the IEF and Proxy IEF apps configured in the AD directory:
  <a href="https://i.stack.imgur.com/0EDoy.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/0EDoy.png" alt="enter image description here"></a></p>
  
  <p>And we have the <code>login-NonInteractive</code> technical profile configured in TrustFrameworkExtensions.xml:
  <a href="https://i.stack.imgur.com/r4z40.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/r4z40.png" alt="enter image description here"></a></p>
  
  <p>Having wired up Application Insights (following these instructions <a href="https://docs.microsoft.com/en-us/azure/active-directory-b2c/active-directory-b2c-troubleshoot-custom" rel="nofollow noreferrer">https://docs.microsoft.com/en-us/azure/active-directory-b2c/active-directory-b2c-troubleshoot-custom</a>), we're able to get to this more detailed error:</p>
  
  <blockquote>
    <p>AADSTS70001: Application with identifier
    'ProxyIdentityExperienceFrameworkAppID' was not found in the directory
    weapageengine.onmicrosoft.com</p>
  </blockquote>
  
  <p>The only place 'ProxyIdentityExperienceFrameworkAppID' appears in any of our custom policies is shown in the XML snipped above, but this seems correct as per the documentation here: <a href="https://github.com/Azure-Samples/active-directory-b2c-custom-policy-starterpack/blob/3b4898fec3bf0014b320beffa6eb52ad68eb6111/SocialAndLocalAccounts/TrustFrameworkExtensions.xml#L38" rel="nofollow noreferrer">https://github.com/Azure-Samples/active-directory-b2c-custom-policy-starterpack/blob/3b4898fec3bf0014b320beffa6eb52ad68eb6111/SocialAndLocalAccounts/TrustFrameworkExtensions.xml#L38</a> - unless we are meant to update those 'DefaultValue' attributes as well?</p>
  
  <p><strong>Resolution:</strong>
  As per the answer below, it is necessary to update both the Metadata and the default values with the relevant app ids. Worth noting that in the GitHub sample <a href="https://github.com/Azure-Samples/active-directory-b2c-custom-policy-starterpack/blob/3b4898fec3bf0014b320beffa6eb52ad68eb6111/SocialAndLocalAccounts/TrustFrameworkExtensions.xml#L38" rel="nofollow noreferrer">https://github.com/Azure-Samples/active-directory-b2c-custom-policy-starterpack/blob/3b4898fec3bf0014b320beffa6eb52ad68eb6111/SocialAndLocalAccounts/TrustFrameworkExtensions.xml#L38</a> the boilerplate values are differently cased, leading to our missing one in a replace-all: </p>
  
  <p><a href="https://i.stack.imgur.com/qxHXS.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/qxHXS.png" alt="enter image description here"></a></p>