CIAM Token Issuance Start event ignores public REST API endpoint

Question

Hello Microsoft Support Team,

We are experiencing an inconsistency between the official documentation and the actual runtime behavior of Microsoft Entra External ID (CIAM) related to Token Issuance Start events.

Scenario

We configured a Token Issuance Start custom authentication extension in Microsoft Entra External ID (CIAM) to enrich tokens with custom claims from an external system.

According to the official documentation, the REST API endpoint for token issuance events can be:

• Azure Function
• Azure Logic App
• or another publicly available REST API endpoint

We implemented a publicly accessible REST API endpoint:

• No authentication
• HTTPS
• Returns HTTP 200
• Content-Type: application/json

Response schema strictly follows the documented token issuance action contract

Observed behavior:

The REST API endpoint was not invoked at all

But the API returns a valid HTTP 200 response with expected claims

As a result, the claims are NOT added to the issued token

No errors, warnings, or failures.

When the same logic is hosted behind an Azure Function (HTTP trigger):

• The token issuance event works as expected
• Custom claims are successfully added to the token

Expected behavior

Based on the documentation, a public REST API endpoint should be supported for token issuance start events in CIAM, provided it conforms to the required contract.

Question

Can you please confirm one of the following:

• Is there a current limitation in Microsoft Entra External ID (CIAM) where Token Issuance Start events are only supported with Azure Functions, despite the documentation stating otherwise?
• If public REST APIs are supported, are there additional undocumented requirements or restrictions (runtime allow-listing, endpoint validation, hosting constraints, etc.) specific to CIAM?

If this is a known limitation or behavior gap, we would appreciate confirmation and any available roadmap or documentation update plans.

Thank you for your assistance.

Answer 1

Hello Yuliia Bashko,

According to your update, a problem with the REST implementation side was found and resolved by using an Azure Function as a proxy. Following that, the Azure Function's flow operated as intended.

As of right now, establishing a direct connection between the Token Issuance Start custom authentication extension and the REST API is also operating as planned. Despite the previous claim that only Azure-hosted endpoints were supported, this demonstrates that REST integration is operating as intended.

Let me know if any further queries - feel free to reach out!

Answer 2

Hi,
Based on your recommendation, I initially introduced an Azure Function as a proxy and discovered an issue on the REST implementation side, which I fixed. After that, the flow worked correctly.

Today, I connected the REST API directly to the Token Issuance Start custom authentication extension, and it is also working.

This confirms that the REST integration itself is functioning correctly, despite the earlier statement that REST would not work in this scenario.

Answer 3

Based on the information provided in the context, the Token Issuance Start event in Microsoft Entra External ID (CIAM) is designed to support various types of REST API endpoints, including publicly available ones. However, there may be specific requirements or configurations that need to be met for these endpoints to function correctly with the token issuance events.

While the documentation states that a public REST API endpoint can be used, it does not explicitly detail any additional undocumented requirements that might affect its invocation. The observed behavior where the public API endpoint is not invoked, despite returning a valid response, could indicate a limitation or requirement that is not clearly documented.

To address your questions:

• There may be current limitations or specific configurations required for public REST APIs that are not fully outlined in the documentation.
• It is advisable to check for any runtime allow-listing, endpoint validation, or hosting constraints that could affect the behavior of your public REST API in this context.

For further assistance, consider reaching out to Microsoft support directly to confirm these details and inquire about any known limitations or future updates to the documentation regarding this behavior.

---

References:

• Extend authentication flows with your own business logic
• Custom claims provider
• Custom authentication extensions overview
• Supported features in workforce and external tenants
• Authentication events trigger for Azure Functions client library for .NET