How to map a user custom security attribute to OIDC id and access token ?

Question

How to map a user custom security attribute to OIDC id and access token ?

• We have created custom security attribute to map some extension fields for the user.
• We tried to map these as tokens,
  • but the custom security attributes doesn't show up in the dropdown under the token > add optional claims 
  • We then tried to define them under the Enterprise App > Single SignOn > Attributes & Claims; but unable to find these custom security attributes in the drop down there either !

 Any help for this problem is deeply appreciated.

Thanks, chris

Answer 1

Hi @Chris Rollings,

I understand that you want to map a user custom security attribute to OIDC id and access token, but it is not possible to get Custom security attributes as a part of OIDC id and access token. Refer: Can Azure return "Custom security attributes" as part of JWT claims? - Microsoft Q&A

Hence as a workaround you can make use of extension properties as optional claim in Microsoft Entra ID application instead of custom security attributes.

Create an extension property:

POST https://graph.microsoft.com/v1.0/applications/appObjID/extensionProperties

Content-type: application/json

{

    "name": "sampleid",

    "dataType": "String",

    "targetObjects": [

        "User"

    ]

}

Assign a value to this property to a user:

PATCH https://graph.microsoft.com/v1.0/users/<upn>

Content-type: application/json

{

  "extension_e328572xxxxxxxxxx_sampleid": "12345"

}

Configure optional claim in Microsoft Entra ID application:

For sample, I generated tokens:

When decoded extn.sampleid claim is present in tokens:

Access Token:

ID Token:

Otherwise, you can configure custom claims provider. Refer Create a REST API for a token issuance event in Azure Functions - Microsoft identity platform | Microsoft Learn, where you can create a HTTPS trigger function in Azure function app and create a custom extension, configure the custom claims in the Enterprise Application. Hope this helps!

---

If this answer was helpful, please click "Accept the answer" and mark Yes, as this can be beneficial to other community members.

If you have any other questions or still running into more issues, let me know in the "comments" and I would be happy to help you.