GraphServiceClient.Users.PostAsync Ignores B2C Password Complexity Configuration

Describe the bug

Issue:

When creating new users with GraphServiceClient.Users.PostAsync, the password complexity rules defined in Azure AD B2C configuration files (like B2C_1A_TRUSTFRAMEWORKEXTENSIONS.xml) are not enforced. This creates a discrepancy between user self-registration through the web flow (which respects the complexity rules) and programmatic user creation.

Desired Behavior:

Our new business requirement dictates initial passwords to be less complex, consisting only of digits and being 6 characters long (e.g., 123456). We followed the Microsoft documentation on configuring password complexity for Azure AD B2C (https://learn.microsoft.com/en-us/azure/active-directory-b2c/password-complexity?pivots=b2c-custom-policy). This configuration works as expected for user self-registration through the web flow.

However, GraphServiceClient.Users.PostAsync bypasses these settings when creating users programmatically. Instead, it enforces a default complexity rule (likely 8-64 characters with various character types). This is confirmed by the error message "The specified password does not comply with password complexity requirements. Please provide a different password."

Question:

Does GraphServiceClient not consider custom Azure AD B2C policy configurations?

Goal:

Is there a way to programmatically create users with GraphServiceClient while enforcing a simple, 6-digit password requirement (only digits)?

Thank you for any assistance!

Expected behavior

After configuring password complexity rules, GraphServiceClient to enforce new password complexity rules.

How to reproduce

Change ADB2C configuration and make password complexity rules 6 chars long and digit only by following https://learn.microsoft.com/en-us/azure/active-directory-b2c/password-complexity?pivots=b2c-custom-policy link. Then the new simple password complexity rules should allow you to register a new user with simple 6 digits only password.

Then try to create user programmatically by using code like below.

` var result1 = await graphClient.Users
.PostAsync(new User
{
GivenName = firstName,
Surname = lastName,
DisplayName = firstName + " " + lastName,
Identities = new List
{
new ObjectIdentity()
{
SignInType = "emailAddress",
Issuer = config.Tenant,
IssuerAssignedId = email
}
},
PasswordProfile = new PasswordProfile()
{
Password = password,
ForceChangePasswordNextSignIn = false
},
PasswordPolicies = "DisablePasswordExpiration"

                                                });`

SDK Version

5.62.0

Latest version known to work for scenario above?

No response

Known Workarounds

No response

Debug output

</details>


### Configuration

Windows 11

### Other information

_No response_

Start by comparing the Azure AD B2C password-complexity documentation with the GraphServiceClient.Users.PostAsync request and the reported SDK version 5.62.0. Reproduce the six-digit password case using the issue's sample, then determine whether the behavior is imposed by the service or differs in the SDK. Done means a confirmed supported behavior, workaround, or actionable SDK defect.