wids field is not being populated with custom user role template ID for device authorization flow

Howell Yang 40 Reputation points
2023-07-11T22:22:07.3533333+00:00

Hi there,

I have an application dedicated to device authorization flow. I have created various custom user accounts with various custom user roles. When I get my JWT ID token, the wids field is not being populated with the template ID of the custom role. The wids field always comes as: "b79fbf4d-3ef9-4689-8143-76b194e85509"

Is there a way to have custom roles show up in wids field of the ID token? Or only built-in roles are allowed?

Thanks,

Howell

Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
18,580 questions
0 comments No comments
{count} votes

Accepted answer
  1. Marilee Turscak-MSFT 32,286 Reputation points Microsoft Employee
    2023-07-21T00:18:00.1333333+00:00

    @Howell Yang ,

    The documentation says, "The wid claim represents the tenant-wide roles assigned to the user from the roles present in the Azure AD built-in roles."

    Based on the claims validation guide, the directory role template object IDs should only populate within the wids claim for built-in/directory roles. The role to template ID mapping is documented here.

    You mentioned that you created a custom role and add the templateId optional parameter. Based on my understanding and what is stated in the documentation, I do not believe that the wid claim from the custom role templateId should populate. (I did send a note though to the product team to confirm that the documentation is up-to-date, and will update this post if I hear otherwise.)

    When you create a work account in Azure AD without granting any roles, the b79fbf4d-3ef9-4689-8143-76b194e85509 id will be populated into the wids claim. This exists in all non-guest accounts of the tenant.

    Let me know if you have further questions.

    If the information helped you, please Accept the answer. This will help us and serve as a reference for others in the community who may be researching similar questions.

    0 comments No comments

0 additional answers

Sort by: Most helpful