How do I add both 'email' and 'emails' as claims in a custom Azure AD B2C policy?

Question

When using a User Flow in Azure AD B2C, the token includes a claim called 'emails' that's an array. We have an application that expects 'email' (singular) instead. To handle that, I created an IEF custom policy using the starter pack from GitHub. I added the following line to the <OutputClaims> section of the SignUpOrSignin.xml file:

<OutputClaim ClaimTypeReferenceId="signInNames.emailAddress" PartnerClaimType="email"/>

That provided a claim called 'email' as a string, which is perfect. However, they also want the 'emails' claim in the token as well, to avoid changing any of their application code. How can I also add the 'emails' array to the token, like the old User Flow did?

Answer 1

Hi @MJL,

Based on your query, here is my understanding: you would like to have 'email' and 'emails' as output claim for the application.

In order to achieve your end goal, you need to ensure you have provided othermails to the user using claims transformation. You must create the otherMails claim from the email claim using the CreateOtherMailsFromEmail claims transformation and then persist the otherMails claim in the AAD-UserWriteUsingLogonEmail technical profile.

Technical profile for CreateOtherMailsFromEmail: StringCollection claims transformations

<ClaimsTransformation Id="CreateOtherMailsFromEmail" TransformationMethod="AddItemToStringCollection">
  <InputClaims>
    <InputClaim ClaimTypeReferenceId="email" TransformationClaimType="item" />
    <InputClaim ClaimTypeReferenceId="otherMails" TransformationClaimType="collection" />
  </InputClaims>
  <OutputClaims>
    <OutputClaim ClaimTypeReferenceId="otherMails" TransformationClaimType="collection" />
  </OutputClaims>
</ClaimsTransformation>

Now you need to update this othermails as emails claim in all technical profile for interacting with a claim's provider as follows:

• AAD-UserReadUsingAlternativeSecurityId and AAD-UserReadUsingAlternativeSecurityId-NoError - Look up a social account in the directory.
• AAD-UserWriteUsingAlternativeSecurityId - Create a new social account.
• AAD-UserReadUsingEmailAddress - Look up a local account in the directory.
• AAD-UserWriteUsingLogonEmail - Create a new local account.
• AAD-UserWritePasswordUsingObjectId - Update a password of a local account.
• AAD-UserWriteProfileUsingObjectId - Update a user profile of a local or social account.
• AAD-UserReadUsingObjectId - Read a user profile of a local or social account.
• AAD-UserWritePhoneNumberUsingObjectId - Write the MFA phone number of a local or social account

Here is the information on configuration of output claims in technical profiles: Microsoft Entra technical profile operations.

You can also use the following stack overflow thread as reference: Emails in claims as they have worked on the same end goal.

I hope this information is helpful. Please feel free to reach out if you have any further questions.

If the answer is helpful, please click "Accept Answer" and kindly "upvote it". If you have extra questions about this answer, please click "Comment".