Azure AD Token Customization

In the manifest file for your application you need to update the claims.

If adding roles under custom claim does not work directly, consider creating a policy using Azure AD B2C (if you are using it). Policies allow more granular control over token issuance.

Refer to the official Azure AD B2C documentation for creating and managing custom policies:

Azure AD B2C custom policies

For your requirements, the manifest update should look something like this:

{

  "optionalClaims": {

    "idToken": [

      {

        "name": "roles",

        "source": null,

        "essential": false,

        "additionalProperties": [

          {

            "source": "group",

            "value": "http://schemas.microsoft.com/ws/2008/06/identity/claims/role"

          }

        ]

      },

      {

        "name": "given_name",

        "source": null,

        "essential": false,

        "additionalProperties": [

          {

            "value": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname"

          }

        ]

      },

      {

        "name": "surname",

        "source": null,

        "essential": false,

        "additionalProperties": [

          {

            "value": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname"

          }

        ]

      }

    ]

  }

}

Hi @Dinesh Prajapati

Thank you for posting this in Microsoft Q&A.

I understand that you're trying to modify the claims that are included in the JWT token that is generated by your Azure AD application. Specifically, you want to include the app roles as a claim with the http://schemas.microsoft.com/ws/2008/06/identity/claims/role type, and you want to add two additional claims for the user's first name and last name.

Your app gets roles claim in your token (ID token for app, access token for APIs) with all the signed-in user's assigned roles as shown in the following token example.

For your reference: https://learn.microsoft.com/en-us/security/zero-trust/develop/configure-tokens-group-claims-app-roles#groups-and-app-roles

Within the SAML tokens, these claims have come the following URI format: http://schemas.microsoft.com/identity/claims/<attributename>

To get claims in this formathttp://schemas.microsoft.com/ws/2008/06/identity/claims/role.Please follow the below steps:

1. Sign in to the Microsoft Entra admin center as at least a Cloud Application Administrator.
2. Browse to Identity > Applications > Enterprise applications > All applications.
3. Select New application > create your application > Enter name of the application > Select non-gallery app > Click on create.
4. Select the application, select Single sign-on in the left-hand menu, and then select Edit in the Attributes & Claims section.

By default, the Microsoft identity platform issues a SAML token to an application that contains a claim with a value of the user's username (also known as the user principal name), which can uniquely identify the user. The SAML token also contains other claims that include the user's email address, first name, and last name.

You can add new claim as per your requirement. For more information, please refer this document: Customize SAML token claims

To Test this application > Enterprise application > select your application > Single sign-on > Click on test this application. Once this is done, your enterprise application will receive claims which you configure.

In the user profile, make sure to include the property values, such as the surname and given name. If the user profile does not contain the values, you will not receive the claims in the SAML token.

Hope this helps. Do let us know if you any further queries.

Thanks,

Navya.

If the answer is helpful, please click "Accept Answer" and kindly "upvote" it.