Wrong SAML Claims for AppRoles

Question

Hello,

I am configuring the SAML claims for Enterprise Application in Azure.

For the moment I have configured them like that:

and I have tested connection to target app. Everything is fine and app can read custom_roles.

Unfortunately additionally to 'custom_roles' claim we also have same values in claims called 'http://schemas.microsoft.com/ws/2008/06/identity/claims/role'.

I have tried to use that value in 'custom_roles' Namespace, but then I instead of 'custom_roles' I have 'http://schemas.microsoft.com/ws/2008/06/identity/claims/role/custom_roles'.

Any idea from where 'http://schemas.microsoft.com/ws/2008/06/identity/claims/role' comes from and how to remove it from SAML claims?

Regards

Rafal Fraczek

Answer 1

@Fraczek, Rafal SW/WRO-DCDZA

Thank you for your patience. I have reproduced this issue in my lab.

The behavior is, once you configure any custom roles to the application in Entra ID enterprise apps, by default there is a app role claim that gets added for application. You don't need to add the custom claim separately for app roles.

I have reproduced this behaviour in my lab and this is by design.

As per your query above you wanted to know on how you can remove the "http://schemas.microsoft.com/ws/2008/06/identity/claims/role" claim from application?

I have reached out to our PG team to get information on the same as we are not sure if there is any way to remove some of the default claims.