How do I enable Custom Authentication Extensions for my CIAM tenant - GET works but POST fails with validation errors?

Question

How do I enable Custom Authentication Extensions for my CIAM tenant - GET works but POST fails with validation errors?

Rick Gregory 25

I'm trying to use Custom Authentication Extensions in an Azure External ID (CIAM) tenant but cannot create extensions despite having proper permissions.

Tenant Type: Azure External ID (CIAM) Tenant ID: 685b0e61-9989-4252-8f1b-993dc4859f4d

What Works:

GET requests to /v1.0/identity/customAuthenticationExtensions succeed (returns empty array)
GET requests to /v1.0/identity/authenticationEventListeners succeed (returns empty array)
Successfully obtained access token with CustomAuthenticationExtension.ReadWrite.All application permission
User has Global Administrator role

What Fails:

POST requests to create custom authentication extension fail with:I'm trying to use Custom Authentication Extensions in an Azure External ID (CIAM) tenant but cannot create extensions despite having proper permissions. Tenant Type: Azure External ID (CIAM)
Tenant ID: 685b0e61-9989-4252-8f1b-993dc4859f4d What Works:
- GET requests to /v1.0/identity/customAuthenticationExtensions succeed (returns empty array)
- GET requests to /v1.0/identity/authenticationEventListeners succeed (returns empty array)
- Successfully obtained access token with CustomAuthenticationExtension.ReadWrite.All application permission
- User has Global Administrator role
What Fails:
- POST requests to create custom authentication extension fail with: { "error": {
```
"code": "AADB2C",

"message": "The custom extension should be of subtype of CustomAuthenticationExtension"
```
  } }

Steps to Reproduce:

Create app registration with CustomAuthenticationExtension.ReadWrite.All (application permission)
Grant admin consent
Obtain access token via client credentials flow
Attempt POST to https://graph.microsoft.com/v1.0/identity/customAuthenticationExtensions

Question: Is there a tenant-level feature flag that needs to be enabled for CIAM tenants to create Custom Authentication Extensions? The Portal UI doesn't show "Custom authentication extensions" menu item in the Security blade for CIAM tenants either.

VEMULA SRISAI 13,140 Reputation points Microsoft External Staff Moderator

2025-12-18T13:09:08.31+00:00
Hello Rick Gregory,

It sounds like you're running into some snags trying to create Custom Authentication Extensions in your Azure CIAM tenant. Let's break down the situation.

It appears that your GET requests are working just fine, which means your setup is partially correct. However, you're facing validation errors when performing a POST to create the custom authentication extension. The error message you're seeing — "The custom extension should be of subtype of CustomAuthenticationExtension" — usually indicates that the structure or type of the data you're sending doesn't match the expected format.

Here are some steps you can take to troubleshoot this issue:

Check the Request Body: Ensure that the structure of your POST request complies with the expected schema for creating a Custom Authentication Extension. The JSON payload should correctly reflect the subtype required by Microsoft Entra.

Review Resource Types: Verify that you are using the correct resource types and properties that relate to your extension. Make sure to define any necessary properties that align with the specifications outlined in the documentation.

Tenant-Level Feature Flags: As you mentioned wondering if there's a tenant-level feature flag needed to utilize Custom Authentication Extensions, it's essential to confirm if your tenant has specific configurations or restrictions. Azure may require enabling certain features or settings for CIAM tenants to use this functionality.

Utilize Examples: Sometimes looking at example requests can clarify the structure you're supposed to follow. Check any official examples and try to structure your POST request similarly.

Follow-Up Questions

To help you better, here are a few clarifying questions:

Can you share the specific JSON payload you're using in your POST request?

Have you looked into the documentation for the exact requirements on the request structure for Custom Authentication Extensions?

Are there any additional logs or error messages beyond the one shared that might provide more context?

Have you confirmed that all necessary permissions and roles are properly granted within your CIAM tenant?

Looking forward to your response, and hopefully, we can get this sorted out!

Reference Links

Custom authentication extensions overview

Authentication through custom code

Microsoft Entra ID for customers,
Rick Gregory 25 Reputation points

2025-12-18T16:39:20.4133333+00:00
Thank you for the response! I appreciate the help. The last Reference Link above returns 404. Here are answers to your questions:

1. JSON Payload Used:

I've tested multiple payload structures. Here's the most recent attempt:

{

"@odata.type": "#microsoft.graph.onTokenIssuanceStartCustomExtension",

"displayName": "EntPOWEREDGraph-Passkey-Auth",

"description": "FIDO2 passkey authentication with IDP abstraction",

"endpointConfiguration": {

"@odata.type": "#microsoft.graph.httpRequestEndpoint", "targetUrl": "https://fa-entpg-patient-dev.azurewebsites.net/api/ciam/auth-extension"

},

"claimsForTokenConfiguration": [

{ "claimIdInApiResponse": "passkey_available" }, { "claimIdInApiResponse": "authentication_method" }

]

}

This resulted in: "The 'authenticationConfiguration' field is invalid in request. "When I added authenticationConfiguration with azureAdTokenAuthentication, I got: "The custom extension should be of subtype of CustomAuthenticationExtension".

2. Documentation Review:

I've reviewed the official documentation, but it largely covers workforce tenants. The examples that I have seen don't specify CIAM-specific requirements or limitations.

3. Additional Context:

Error Code Pattern: All errors return code "AADB2C" (not standard Graph API errors)

Azure Portal UI: The "Custom authentication extensions" menu doesn't appear in Security blade for CIAM tenants (it exists in workforce Entra ID)

App Registration: App ID (available if needed) with CustomAuthenticationExtension.ReadWrite.All application permission, admin-consented

I also have correlation IDs if they would be helpful.

4. Permissions Confirmed:

Global Administrator role

CustomAuthenticationExtension.ReadWrite.All (application permission, admin-consented)

Successfully obtaining access tokens

GET operations work on both v1.0 and beta endpoints

Answer accepted by question author

0 additional answers

Your answer

Rick Gregory 25 Reputation points

2025-12-18T16:39:20.4133333+00:00

Thank you for the response! I appreciate the help. The last Reference Link above returns 404. Here are answers to your questions:

1. JSON Payload Used:

I've tested multiple payload structures. Here's the most recent attempt:

{

"@odata.type": "#microsoft.graph.onTokenIssuanceStartCustomExtension",

"displayName": "EntPOWEREDGraph-Passkey-Auth",

"description": "FIDO2 passkey authentication with IDP abstraction",

"endpointConfiguration": {

"@odata.type": "#microsoft.graph.httpRequestEndpoint", "targetUrl": "https://fa-entpg-patient-dev.azurewebsites.net/api/ciam/auth-extension"

},

"claimsForTokenConfiguration": [

{ "claimIdInApiResponse": "passkey_available" }, { "claimIdInApiResponse": "authentication_method" }

]

}

This resulted in: "The 'authenticationConfiguration' field is invalid in request. "When I added authenticationConfiguration with azureAdTokenAuthentication, I got: "The custom extension should be of subtype of CustomAuthenticationExtension".

2. Documentation Review:

I've reviewed the official documentation, but it largely covers workforce tenants. The examples that I have seen don't specify CIAM-specific requirements or limitations.

3. Additional Context:

Error Code Pattern: All errors return code "AADB2C" (not standard Graph API errors)

Azure Portal UI: The "Custom authentication extensions" menu doesn't appear in Security blade for CIAM tenants (it exists in workforce Entra ID)

App Registration: App ID (available if needed) with CustomAuthenticationExtension.ReadWrite.All application permission, admin-consented

I also have correlation IDs if they would be helpful.

4. Permissions Confirmed:

Global Administrator role

CustomAuthenticationExtension.ReadWrite.All (application permission, admin-consented)

Successfully obtaining access tokens

GET operations work on both v1.0 and beta endpoints

Answer 1

RoryB 620

The only CIAM custom extensions are under "External Identities | Custom authentication extensions".

You mention "FIDO2 passkey authentication"?

Passkeys are not supported in CIAM.

Rick Gregory 25 Reputation points

2025-12-19T17:18:23.3766667+00:00

RoryB,

I wanted to follow up and thank you for your guidance on the Custom Authentication Extension implementation. Your direction confirmed to me the features availability in the CIAM tenant and was exactly what was needed to move forward.

Following your advice, I've successfully registered the Custom Authentication Extension in the CIAM tenant with TokenIssuanceStart event type. I created the Authentication Event Listener via Microsoft Graph API and connected it to the application, configured OAuth 2.0 Authentication with proper API scopes, pre-authorized the Azure AD Authentication Extensions service, and granted admin consent. Deployed and verified the endpoint is reachable and returns the correct response schema per Microsoft Graph documentation. The configuration is now in-place and the infrastructure is ready.

I am currently seeing error code 1003002 during token issuance after Email OTP authentication completes. Interestingly, the endpoint responds correctly when tested directly, and Application Insights shows no requests reaching it, which suggests CIAM may be encountering an issue before successfully making the call. I continue to investigate the validation logic in our endpoint code.

Nevertheless, i wanted to thank you again for your timely assistance and for confirming the feature availability. It made all the difference in our implementation!

Best regards

Share via

How do I enable Custom Authentication Extensions for my CIAM tenant - GET works but POST fails with validation errors?

Follow-Up Questions

Reference Links

0 additional answers

Your answer