<UserJourney Id="AccountLinkAndUnlink">
      <OrchestrationSteps>
        <OrchestrationStep Order="1" Type="CombinedSignInAndSignUp"
          ContentDefinitionReferenceId="api.signuporsignin">
          <ClaimsProviderSelections>
            <!--Sample:
            IDP selection for sign-in with local or federated account -->
            <!-- <ClaimsProviderSelection TargetClaimsExchangeId="FacebookExchange"/> -->
            <ClaimsProviderSelection TargetClaimsExchangeId="MicrosoftAccountExchange" />
            <ClaimsProviderSelection TargetClaimsExchangeId="GoogleExchange" />
            <ClaimsProviderSelection TargetClaimsExchangeId="AppleExchange" />
            <ClaimsProviderSelection TargetClaimsExchangeId="TwitterExchange" />
            <ClaimsProviderSelection ValidationClaimsExchangeId="LocalAccountSigninEmailExchange" />
          </ClaimsProviderSelections>
          <ClaimsExchanges>
            <ClaimsExchange Id="LocalAccountSigninEmailExchange"
              TechnicalProfileReferenceId="SelfAsserted-LocalAccountSignin-Email" />
          </ClaimsExchanges>
        </OrchestrationStep>
        <OrchestrationStep Order="2" Type="ClaimsExchange">
          <Preconditions>
            <Precondition Type="ClaimsExist" ExecuteActionsIf="true">
              <Value>objectId</Value>
              <Action>SkipThisOrchestrationStep</Action>
            </Precondition>
          </Preconditions>
          <ClaimsExchanges>
            <ClaimsExchange Id="MicrosoftAccountExchange" TechnicalProfileReferenceId="MSA-OIDC-SignIn" />
            <ClaimsExchange Id="GoogleExchange" TechnicalProfileReferenceId="Google-OAUTH-SignIn" />
            <ClaimsExchange Id="AppleExchange" TechnicalProfileReferenceId="Apple-OAUTH-SignIn" />
            <ClaimsExchange Id="TwitterExchange" TechnicalProfileReferenceId="Twitter-SignIn"/>
            <ClaimsExchange Id="SignUpWithLogonEmailExchange" TechnicalProfileReferenceId="LocalAccountSignUpWithLogonEmail" />
          </ClaimsExchanges>
        </OrchestrationStep>
        <!-- For social IDP authentication, attempt to find the user account in the directory. -->
        <OrchestrationStep Order="3" Type="ClaimsExchange">
          <Preconditions>
            <Precondition Type="ClaimEquals" ExecuteActionsIf="true">
              <Value>authenticationSource</Value>
              <Value>localAccountAuthentication</Value>
              <Action>SkipThisOrchestrationStep</Action>
            </Precondition>
          </Preconditions>
          <ClaimsExchanges>
            <ClaimsExchange Id="AADUserReadUsingUserIdentity"
              TechnicalProfileReferenceId="AAD-UserReadUsingUserIdentity-NoError" />
          </ClaimsExchanges>
        </OrchestrationStep>
        <!-- Show self-asserted page only if the directory does not have the user account already
        (i.e. we do not have an objectId).
          This can only happen when authentication happened using a social IDP. If local account was created
        or authentication done
          using ESTS in step 2, then an user account must exist in the directory by this time. -->
        <OrchestrationStep Order="4" Type="ClaimsExchange">
          <Preconditions>
            <Precondition Type="ClaimsExist" ExecuteActionsIf="true">
              <Value>objectId</Value>
              <Action>SkipThisOrchestrationStep</Action>
            </Precondition>
          </Preconditions>
          <ClaimsExchanges>
            <ClaimsExchange Id="SelfAsserted-Social-v2"
              TechnicalProfileReferenceId="SelfAsserted-Social-v2" />
          </ClaimsExchanges>
        </OrchestrationStep>
        <!-- This step reads any user attributes that we may not have received when authenticating
        using ESTS so they can be sent
          in the token. -->
        <OrchestrationStep Order="5" Type="ClaimsExchange">
          <Preconditions>
            <Precondition Type="ClaimEquals" ExecuteActionsIf="true">
              <Value>authenticationSource</Value>
              <Value>socialIdpAuthentication</Value>
              <Action>SkipThisOrchestrationStep</Action>
            </Precondition>
          </Preconditions>
          <ClaimsExchanges>
            <ClaimsExchange Id="AADUserReadWithObjectId"
              TechnicalProfileReferenceId="AAD-UserReadUsingObjectId" />
          </ClaimsExchanges>
        </OrchestrationStep>
        <!-- The previous step (SelfAsserted-Social) could have been skipped if there were no
        attributes to collect
             from the user. So, in that case, create the user in the directory if one does not already exist
             (verified using objectId which would be set from the last step if account was created in the
        directory. -->
        <OrchestrationStep Order="6" Type="ClaimsExchange">
          <Preconditions>
            <Precondition Type="ClaimsExist" ExecuteActionsIf="true">
              <Value>objectId</Value>
              <Action>SkipThisOrchestrationStep</Action>
            </Precondition>
          </Preconditions>
          <ClaimsExchanges>
            <ClaimsExchange Id="AADUserWrite"
              TechnicalProfileReferenceId="AAD-UserReadUsingUserIdentity-NoError" />
          </ClaimsExchanges>
        </OrchestrationStep>
        <!--Sample:
        (Link and unlink) Displays the sign-in the social account buttons for account linking and
        unlinking.-->
        <OrchestrationStep Order="7" Type="CombinedSignInAndSignUp"
          ContentDefinitionReferenceId="api.idpselections">
          <ClaimsProviderSelections DisplayOption="ShowSingleProvider">

            <!--MSA-->
            <ClaimsProviderSelection TargetClaimsExchangeId="LinkMicrosoftAccountExchange" />
            <ClaimsProviderSelection TargetClaimsExchangeId="UnlinkMicrosoftAccountExchange" />
            <!--Google-->
            <ClaimsProviderSelection TargetClaimsExchangeId="LinkGoogleExchange" />
            <ClaimsProviderSelection TargetClaimsExchangeId="UnlinkGoogleExchange" />
            <!--Apple-->
            <ClaimsProviderSelection TargetClaimsExchangeId="LinkAppleExchange" />
            <ClaimsProviderSelection TargetClaimsExchangeId="UnlinkAppleExchange" />
            <!--Sample:
            Twitter-->
            <ClaimsProviderSelection TargetClaimsExchangeId="LinkTwitterExchange"/>
            <ClaimsProviderSelection TargetClaimsExchangeId="UnlinkTwitterExchange"/>
          </ClaimsProviderSelections>
        </OrchestrationStep>
        <!-- Sample: (Link and unlink) Redirect the user to the selected social provider, to
        complete the sign-in and link the new account -->
        <OrchestrationStep Order="8" Type="ClaimsExchange">
          <ClaimsExchanges>
            <ClaimsExchange Id="LinkMicrosoftAccountExchange" TechnicalProfileReferenceId="MSA-OAUTH-Link" />
            <ClaimsExchange Id="UnlinkMicrosoftAccountExchange" TechnicalProfileReferenceId="MSA-Unlink" />
            <ClaimsExchange Id="LinkGoogleExchange" TechnicalProfileReferenceId="Google-OAUTH-Link" />
            <ClaimsExchange Id="UnlinkGoogleExchange" TechnicalProfileReferenceId="Google-Unlink" />
            <ClaimsExchange Id="LinkAppleExchange" TechnicalProfileReferenceId="Apple-OAUTH-Link" />
            <ClaimsExchange Id="UnlinkAppleExchange" TechnicalProfileReferenceId="Apple-Unlink" />
            <ClaimsExchange Id="LinkTwitterExchange" TechnicalProfileReferenceId="Twitter-Link" />
            <ClaimsExchange Id="UnlinkTwitterExchange" TechnicalProfileReferenceId="Twitter-Unlink"/>
          </ClaimsExchanges>
        </OrchestrationStep>
        <!-- Sample: (Link only) Attempt to find the second user account in the directory. -->
        <OrchestrationStep Order="9" Type="ClaimsExchange">
          <Preconditions>
            <Precondition Type="ClaimEquals" ExecuteActionsIf="true">
              <Value>linkOrUnlink</Value>
              <Value>unlink</Value>
              <Action>SkipThisOrchestrationStep</Action>
            </Precondition>
          </Preconditions>
          <ClaimsExchanges>
            <ClaimsExchange Id="AAADUserReadUsingUserIdentityToLink"
              TechnicalProfileReferenceId="AAD-UserReadUsingUserIdentityToLink-NoError" />
          </ClaimsExchanges>
        </OrchestrationStep>
        <!-- Sample: (Link only) Check whether second user account is existed in the directory.
                     If yes, we can't link second account to the existing one, as the second one already exists as a
        stand along account. -->
        <OrchestrationStep Order="10" Type="ClaimsExchange">
          <Preconditions>
            <Precondition Type="ClaimEquals" ExecuteActionsIf="true">
              <Value>linkOrUnlink</Value>
              <Value>unlink</Value>
              <Action>SkipThisOrchestrationStep</Action>
            </Precondition>
            <Precondition Type="ClaimsExist" ExecuteActionsIf="false">
              <Value>objectIdToLink</Value>
              <Action>SkipThisOrchestrationStep</Action>
            </Precondition>
          </Preconditions>
          <ClaimsExchanges>
            <ClaimsExchange Id="SelfAssertedError" TechnicalProfileReferenceId="SelfAsserted-Error" />
          </ClaimsExchanges>
        </OrchestrationStep>
        <!-- Sample: (Link and unlink) Update the identities collection with the link or unlink
        identity. -->
        <OrchestrationStep Order="11" Type="ClaimsExchange">
          <ClaimsExchanges>
            <ClaimsExchange Id="UpdateUserIdentities"
              TechnicalProfileReferenceId="AAD-UserUpdateWithUserIdentities" />
          </ClaimsExchanges>
        </OrchestrationStep>
        <OrchestrationStep Order="12" Type="SendClaims"
          CpimIssuerTechnicalProfileReferenceId="JwtIssuer" />
      </OrchestrationSteps>
      <ClientDefinition ReferenceId="DefaultWeb" />
    </UserJourney>