Create new custom extension for TokenIssuanceStart failed during creation.

Question

I'm trying to create new custom extension for TokenIssuanceStart but running into error. I'm following this guide:

https://learn.microsoft.com/en-us/entra/identity-platform/custom-extension-tokenissuancestart-setup?tabs=visual-studio%2Cazure-portal&pivots=azure-portal

Specifically YT: https://www.youtube.com/watch?v=_CD3shvqpx4&t=2s

I've downloaded the sample code: https://github.com/microsoft/authentication-events-function

Opened Project in Visual Studio and created and published an Azure Function.

I then went to Entra Admin to create new custom extension but kept getting error like this:

Looking at debug the response error seem to all be "There is a problem with the service.".

Looking at the Audit log it's failing on this step

Is this some particular Role I need to have?

Answer 1

Hello John,

If you encounter the following error while creating a custom extension attribute:

"Error creating custom extension / "code": "AADB2C90063", "message": "There is a problem with the service."

This typically indicates that the Azure Active Directory Authentication Extensions application is absent in your tenant.

Steps to Verify and Resolve:

1. Check for the Application:

• Navigate to Enterprise Applications > All Applications in the Azure portal.
• Search for an application named "Azure Active Directory Authentication Extensions".
  • ⁠Or you can use the below PowerShell command to check .  Get-MgServicePrincipal  
• If the Application is Missing:
• Connect to Microsoft Graph and Create the application using below commands-:

    Connect-MgGraph -TenantId <domain>.onmicrosoft.com -Scopes "Application.ReadWrite.All" 
    New-MgServicePrincipal -AppId 99045fe1-7639-4a75-9d4a-577b6ca3810f
  

After completing these steps, attempt to create the custom extension attribute again. This should resolve the issue.

For reference, here are some screenshots illustrating the process:

If you continue to experience difficulties, please don't hesitate to contact me for further assistance.

Answer 2

Hello @John Le

Thank you for contacting Q&A Forum. Based on your description and process, the issue you’re facing might stem from a few causes including missing permissions, misconfigured Azure Function, or service-side issues. I would suggest you check these following factors:

• Required role to create custom extensions: to create a custom authentication extension, you are required to have one of the following roles:

• Global Administrator
• Cloud Application Administrator

These roles are required to register applications and configure authentication extensions. For more information, please visit this link: Troubleshoot a custom authentication extension - Microsoft identity platform | Microsoft Learn

• Common causes: The error can occur due to:

• Incorrect or missing identifierUris in the app registration. Invalid or missing permissions in the Azure Function app registration.
• Azure Function not returning the correct HTTP status codes (must return 200, 202, or 204).
• Incorrect aud claim in the token sent to the Azure Function.
• Service principal not created or not properly linked.

I would suggest you to follow these troubleshooting steps:

• Check Audit Logs:

• Microsoft Entra Admin Center > Monitoring > Audit Logs
• Look for entries under PolicyManagement with the activity "Validate customExtension authenticationConfiguration".

These logs may show more specific error codes like:

1003001: Unexpected error calling the custom extension API.

1003002: Invalid HTTP status code returned.

1003003: Invalid response body.

• Validate Azure Function:

• Ensure your Azure Function is publicly accessible and does not require authentication (unless configured with a managed identity).

It must return a valid response with the correct schema and status code.

• Check App Registration:

• The identifierUris should be in the format:api://<Function_Hostname>/<AppId>
• Ensure the app registration has the correct exposed API and permissions.

Kindly let me know if any of these works for you and please leave a comment if you have any further questions.

If I have answered your question, please accept this as answer as a token of appreciation and don't forget to give a thumbs up for "Was it helpful"!

Best regards,

Megan.