How can I return the email as claim

Question

I set up a basic signin flow which is using the default IdentityProvider (email with password). I can't find a way of returning the email as claim after signin in?

I believe with Azure B2C you had to set up a custom policy to extract the data from the signinnames.emailaddress field and just return an email claim.

How can I do this with Entra External ID? If not, is there a work-around?

Answer 1

Hi Patrick,

With Microsoft Entra External ID, the behavior of claims differs slightly from Azure AD B2C. By default, Entra External ID uses OpenID Connect (OIDC) or SAML for authentication and authorization, and the returned claims are based on how you've configured your user flows or custom policies. If you're using the default user flow and want to include the email claim in the token, you can follow these steps:I

1. nclude Email Claim in the Token. In Entra External ID, the email claim isn't included by default in tokens unless configured. To include it:

1. Configure the Default User Flow or Custom Policy:

Go to the Azure portal. Navigate to Microsoft Entra ID > External Identities > User flows. Edit the user flow you're using (e.g., SignUpSignIn). Under the Claims section, ensure Email Address is checked. Save the changes.

2. Test the User Flow:

Run the user flow to verify that the email claim is included in the issued token.

2. Retrieve Email from SignInNames

For Entra External ID, the email address of a user is stored in the signInNames attribute. To return this attribute as a claim, you'll need to map it explicitly:

Edit Claim Transformation:

If using custom policies, you'll need to modify the XML file to include a claim mapping for signInNames.emailAddress.

Example (XML snippet):

<OutputClaim ClaimTypeReferenceId="email" PartnerClaimType="signInNames.emailAddress" />

Save the custom policy and upload it to your tenant.

3. Verify Claims in Token

Use a tool like jwt.ms to inspect the token issued after signing in. Look for the email claim in the payload.

Workarounds if Email is Missing

If the email still doesn’t appear in the token:

1. Use Graph API to Fetch User Details: After sign-in, you can call the Microsoft Graph API to fetch the user's profile, including their mail or userPrincipalName attribute.

Example API call:

GET https://graph.microsoft.com/v1.0/me

Authorization: Bearer {access_token}

Ensure the token has the correct User.Read permission.

2. Custom API Backend: If you control the backend that processes the token, you can enrich it by retrieving user details (email) and adding them as custom claims for downstream processing.

Summary

-For default user flows: Ensure Email Address is selected in the Claims section. -For custom policies: Map signInNames.emailAddress to an email claim. -As a fallback: Use Microsoft Graph API to retrieve email post-authentication.