Why password‑less matters for modern APIs
More than 80% of data breaches in 2023 involved compromised credentials, according to the Verizon Data Breach Investigations Report. Developers building Minimal APIs in .NET 8 cannot afford to rely on static passwords any longer. A password‑less experience—driven by Azure AD B2C and Microsoft Entra Verified ID—removes the most exploitable attack vector while keeping user friction low.
Preparing Azure AD B2C for password‑less sign‑in
Start by creating a B2C tenant in the Azure portal (if you do not already have one). Under "User flows", add a new "Sign‑in" flow and enable the "Passwordless" option. Choose either email OTP or FIDO2 security key as the primary method; both are supported out of the box. After publishing the flow, note the tenant name, client ID, and the B2C policy name (for example, B2C_1A_Passwordless).
Next, register a new application in the same tenant. Set the redirect URI to https://localhost:7180/swagger/oauth2-redirect.html for local testing, and grant the "User.Read" permission. Copy the client secret; you will reference it in the Minimal API configuration.
Integrating Microsoft Entra Verified ID
Verified ID (formerly Decentralized Identity) adds a cryptographic credential that proves a user’s identity without exposing personal data. In the Azure portal, navigate to "Microsoft Entra Verified ID" and create a new credential definition. Use the template "Email address verified" for a quick start, then publish the definition. The service returns a "Credential Issuer URL" and a "Verification Policy URL"—both required in the API code.
When a user completes the password‑less sign‑in, Azure AD B2C can issue a Verified ID token as a custom claim. Your Minimal API will validate this claim using the Entra SDK, ensuring that the credential is still valid and has not been revoked.
Configuring the .NET 8 Minimal API
Open a fresh .NET 8 project with dotnet new webapi -minimal. Add the following NuGet packages: Microsoft.Identity.Web, Microsoft.Identity.Web.UI, and Microsoft.VerifiedId. The code snippet below shows a complete startup configuration that wires Azure AD B2C authentication, adds the Verified ID handler, and protects a sample endpoint.
var builder = WebApplication.CreateBuilder(args);
builder.Services.AddAuthentication(options => {
options.DefaultScheme = JwtBearerDefaults.AuthenticationScheme;
})
.AddMicrosoftIdentityWebApi(builder.Configuration.GetSection("AzureAdB2C"));
builder.Services.AddVerifiedId(options => {
options.CredentialIssuerUrl = builder.Configuration["VerifiedId:IssuerUrl"];
options.VerificationPolicyUrl = builder.Configuration["VerifiedId:PolicyUrl"];
});
builder.Services.AddAuthorization();
var app = builder.Build();
app.UseAuthentication();
app.UseAuthorization();
app.MapGet("/weather", [Authorize] () => new[] {
new { Date = DateTime.Now, TemperatureC = 22, Summary = "Sunny" },
new { Date = DateTime.Now.AddDays(1), TemperatureC = 18, Summary = "Cloudy" }
});
app.Run();Notice the AddVerifiedId call; it registers a middleware that extracts the Verified ID JWT from the Authorization header, validates the cryptographic proof, and injects the credential claims into the user principal. The [Authorize] attribute on the /weather endpoint now requires both a valid B2C access token and a Verified ID claim.
Testing the password‑less flow locally
Run the API with dotnet run. Open the Swagger UI that ships with Minimal APIs (https://localhost:7180/swagger) and click the "Authorize" button. Paste the B2C token you receive after completing the password‑less sign‑in (you can obtain it via the Azure AD B2C "Run user flow" feature). Swagger will include the token in subsequent requests, and you should see a JSON array of weather forecasts returned by the protected endpoint.
If the Verified ID credential is missing or revoked, the middleware returns HTTP 401 with a clear error message, allowing your client to prompt the user for re‑verification.
Performance and cost considerations
Azure AD B2C pricing is consumption‑based; a typical password‑less sign‑in costs $0.003 per authentication in the US region (as of 2024). Verified ID verification adds a small overhead—approximately 150 ms per request—due to cryptographic proof checks. In high‑throughput scenarios, cache the verification policy metadata for up to 24 hours to reduce latency.
Monitoring is essential. Enable Azure Monitor logs for both B2C and Entra Verified ID, then create alerts for authentication failures exceeding a 1% threshold. This proactive stance helps you detect credential‑theft attempts before they impact users.
Key takeaways
By combining Azure AD B2C password‑less sign‑in with Microsoft Entra Verified ID, you eliminate the weakest link—passwords—while still delivering a seamless developer experience in .NET 8 Minimal APIs. The approach requires only a handful of configuration steps, a small code addition, and provides cryptographic assurance that the caller truly owns the identity they claim.
Implementing this pattern today positions your API for the next generation of secure, frictionless applications, and aligns with industry‑wide moves toward decentralized identity.
Sources
Microsoft Docs – Azure AD B2C passwordless documentation
Microsoft Docs – Microsoft Entra Verified ID developer guide
Verizon Data Breach Investigations Report 2023
Author: Mahmut Sarıkaya — sarikayadev.com
