B2C Custom Policy: Claim with `PartnerClaimType` returns BOTH claim types

Mike Palgon 40 Reputation points
2025-06-25T15:12:22.9233333+00:00

I am using B2C Custom Policies. I followed this article to add the UserInfo endpoint, Technical Profile, and UserJourney. I also added a RESTful ClaimsProvider to get claims from an api; I followed this article to configure it.

The end-to-end request to the UserInfo endpoint works, including the RESTful API call to get claims.

The issue:

In the Token Issuer ClaimsProvider Technical Profile, I have configured the following claims to be returned by the UserInfo endpoint (note the PartnerClaimType attribute for signInNames.emailAddress):



The problem is, I'm getting the email address back twice: once as signInNames.emailAddress, and another as the PartnerClaimType email:

{
    "objectId": "fd604948-f5a3-4046-ad08-5c7814839ad0",
    "givenName": "Alice",
    "surname": "Allgood",
    "displayName": "Alice Allgood",
    "email": "******@mydomain.xyz",                    <============
    "signInNames.emailAddress": "******@mydomain.xyz"  <============
}

My question:

  • Is this the correct behavior and what's expected? I expected only the email claim to be returned.
  • If this is correct, how can I prevent signInNames.emailAddress from being returned?

(Code for complete UserInfo configuration is below.)

Thanks,

-Mike

ClaimsProvider for UserInfo endpoint:


UserJourney for UserInfo endpoint:

    
    
  

RelyingParty with UserInfo Endpoint configuration:

  
Microsoft Security | Microsoft Entra | Microsoft Entra ID
0 comments No comments
{count} votes

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.