You are designing Azure AD B2C for a mobile app that must support local accounts, Google, and a partner’s SAML IdP. During sign-up/sign-in, you must call a REST API to validate a customer number and include the returned tier as a custom claim in the access token. Which approach should you recommend?

Custom policies (Identity Experience Framework) are necessary here because they offer the flexibility to integrate with both Google (an OIDC provider) and a custom SAML IdP, which built-in user flows do not fully support for all external identity providers. Crucially, custom policies allow for orchestration steps, including calling a REST API during the sign-up/sign-in journey to validate data and then emitting the returned information as a custom claim in the token. Built-in user flows, while simpler, lack the extensibility to call external REST APIs mid-flow for validation and custom claim generation. Azure AD B2B is for collaborating with external users from other Azure AD tenants, not for consumer-facing applications with social or custom IdPs. Microsoft Graph can update user attributes but doesn't integrate into the real-time sign-in flow for claim generation. API Management operates at the gateway level and cannot directly modify claims within an Azure AD B2C issued token.