Azure-docs: The intent of two apps is not clear

[agrabhi]

I used only one app and still it worked. not sure why do we need two apps. Also the significance of each app is not explained.
In an Id token, why do we need two apps?
Without application secret, how these apps are being used?

---

Document Details

⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

• ID: bee63035-00ee-f7fd-97a1-69dae5f808ef
• Version Independent ID: a3447928-73cc-0290-6d46-b89234757e3b
• Content: Get started with custom policies in Azure Active Directory B2C
• Content Source: articles/active-directory-b2c/active-directory-b2c-get-started-custom.md
• Service: active-directory
• GitHub Login: @davidmu1
• Microsoft Alias: davidmu

[MarileeTurscak-MSFT]

@agrabhi
Thanks for your feedback! We will investigate and update as appropriate.

[SaurabhSharma-MSFT]

@agrabhi Azure AD B2C's trust framework internally attempts to obtain a token for the IdentityExperienceFramework app (Web API) using the ProxyIdentityExperienceFramework app (Native app) during the sign in process. You do not need to specify a secret for the client application (ProxyIdentityExperienceFramework) as it is registered as a Native application. The TokenSigningContainer key you have created is used to sign the ID and access tokens that are issued by Azure AD B2C to your relying party applications.

[SaurabhSharma-MSFT]

@agrabhi We will now proceed to close this thread. If there are further questions regarding this matter, please reopen it and we will gladly continue the discussion.

[mike-schenk]

This is still not abundantly clear.

Why is the IdentityExperienceFramework app necessary? Can't the token audience be the same as the application making the request (i.e. the ProxyIdentityExperienceFramework app)?