How to add directory extension to client credentials access token?

Question

Update 30 Jun 2025: after trying many suggestions, I conclude that adding application directory extension as a claim in client credentials is not possible.

My use case is for client credentials where I have 2 apps: ResourceApp and ClientApp.

I have define a directory extension on Resource App: extension_<resource_app_id>_extrainfo

My ClientApp has a directory extension value: extension_<resource_app_id>_extrainfo = "test"

Now, when I want to do client credentials with client_id=<client_app_id> with scope set to Resource App (scope=api://<resource_app_id>/.default), I want the access token JWT claims to contain the value of extension_<resource_app_id>_extrainfo.

Based on what I gathered so far, I tried to use custom mapping policy with this:

{
  "ClaimsMappingPolicy": {
    "Version": 1,
    "IncludeBasicClaimSet": "true",
    "ClaimsSchema": [
      {
        "Source": "application",
        "ExtensionID": "extension_7d62104d35d24b9ea4380ff831bff777_extrainfo",
        "JwtClaimType": "extrainfo"
      },
      {
        "Source": "application",
        "ID": "DisplayName",
        "JwtClaimType": "JWTCLAIM2"
      }
    ]
  }
}

I'm able to get JWTCLAIM2 claim in the client credentials access token, but I'm not able to get the extrainfo claim.

Can someone help to let me know how can I get the extrainfo?

Answer 1

Hello @AndyNugroho,

It seems like your claims mapping policy is applied correctly, as evidenced by the successful inclusion of the DisplayName claim (JWTCLAIM2) in the access token. The issue seems to be with the extrainfo claim not appearing likely stems from how Entra ID handles directory extensions in the context of client credentials flow. Specifically, while the directory extension is defined on the Resource App and set on the Client App, the client credentials flow operates under the context of the Client App’s service principal, not its application object. Directory extensions are stored in servicePrincipal or application objects in Entra ID. In the client credentials flow, the token is issued to the calling application (ClientApp). Claims mapping policy works on the service principal context. Only values present on the servicePrincipal are accessible, not on the application object by default. Directory extensions must be explicitly declared in the schema and synced properly. Entra ID only exposes claims that are present on the service principal when issuing access tokens in app-only flows.

Therefore, to have the extension_<resource_app_id>_extrainfo value included in the token, you need to ensure that this extension attribute is actually set on the Client App's service principal, not just the application. Check if the extension attribute exists on the ClientApp’s service principal and has the defined attribute if not set the value using PATCH command in MS graph. Once the extension attribute is correctly populated on the service principal, and your claims mapping policy includes the appropriate reference to the extension ID, the access token will correctly contain the desired extrainfo claim. Additionally, make sure this claims mapping policy is assigned to the Resource App’s service principal, as it is the API resource issuing the token.

If you have any questions, please do let us know.

Answer 2

Hi @AndyNugroho , 

Thank you for contacting Q&A Forum. I would like to provide my findings and proposed solution:

After checking on your code, I noticed that you used extension attributes for application source. For your information, the extension attributes of app A cannot be added to app B's claim mapping policy. Currently, Microsoft only supports adding user extension attributes to application B's claim mapping policy.  Therefore, you can try to change source to user instead of application for the code to work correctly.

For references, you can take a look on these two documents: 

https://learn.microsoft.com/en-us/entra/identity-platform/reference-claims-customization#claim-schema-entry-elements

Directory extension attributes in claims - Microsoft identity platform | Microsoft Learn 

Kindly let me know if this works for you and please let me know if you have any further questions. 

Best regards,