wids field is not being populated with custom user role template ID for device authorization flow

Question

Hi there,

I have an application dedicated to device authorization flow. I have created various custom user accounts with various custom user roles. When I get my JWT ID token, the wids field is not being populated with the template ID of the custom role. The wids field always comes as: "b79fbf4d-3ef9-4689-8143-76b194e85509"

Is there a way to have custom roles show up in wids field of the ID token? Or only built-in roles are allowed?

Thanks,

Howell

Answer 1

@Howell Yang ,

The documentation says, "The wid claim represents the tenant-wide roles assigned to the user from the roles present in the Azure AD built-in roles."

Based on the claims validation guide, the directory role template object IDs should only populate within the wids claim for built-in/directory roles. The role to template ID mapping is documented here.

You mentioned that you created a custom role and add the templateId optional parameter. Based on my understanding and what is stated in the documentation, I do not believe that the wid claim from the custom role templateId should populate. (I did send a note though to the product team to confirm that the documentation is up-to-date, and will update this post if I hear otherwise.)

When you create a work account in Azure AD without granting any roles, the b79fbf4d-3ef9-4689-8143-76b194e85509 id will be populated into the wids claim. This exists in all non-guest accounts of the tenant.

Let me know if you have further questions.

If the information helped you, please Accept the answer. This will help us and serve as a reference for others in the community who may be researching similar questions.