How can the SAML Contains() claims transformation be configured through Microsoft Graph Claims Mapping Policy?

Question

We are automating Microsoft Entra ID SAML Enterprise Application onboarding using Microsoft Graph PowerShell and ClaimsMappingPolicy.

In the Microsoft Entra Admin Center, under Enterprise Applications → SAML-based Sign-on → Attributes & Claims → Add new claim → Transformation, the Contains() transformation is available.

For example, the GUI allows us to configure:

• Transformation: Contains()
• Parameter 1 (Input): user.employeeid
• Value: 123
• Parameter 2 (Output): user.country
• Optional output if no match: user.userprincipalname

This results in logic equivalent to:

IF user.employeeid contains "123"

    THEN output user.country

ELSE

    output user.userprincipalname

We want to create the same transformation programmatically using Microsoft Graph/PowerShell, while continuing to use a Claims Mapping Policy:

New-MgPolicyClaimMappingPolicy

We currently generate a policy containing:

"ClaimsTransformations": [

  {

    "ID": "...",

    "TransformationMethod": "...",

    "InputClaims": [...],

    "InputParameters": [...],

    "OutputClaims": [...]

  }

]

We found Microsoft's SAML claims customization documentation that documents Contains(), but we cannot determine the corresponding Microsoft Graph ClaimsMappingPolicy JSON representation.

Specifically:

1. Is Contains() supported in a Claims Mapping Policy created through Microsoft Graph?
2. If yes, what is the exact ClaimsTransformation JSON structure for Contains()?
3. What are the correct TransformationClaimType values for the input and output?
4. What are the correct InputParameters names and DataType values?
5. How should an attribute output such as user.country be represented?
6. How should the optional "output if no match" attribute be represented?
7. Is the GUI Contains() transformation implemented using a different policy/API model than ClaimsMappingPolicy?
8. If it is not supported through ClaimsMappingPolicy, what Microsoft Graph API should be used to programmatically create the same SAML claim transformation shown in the Entra Admin Center?

We are specifically looking for an official Microsoft-supported Graph API JSON example for this scenario.

 

We are automating Microsoft Entra ID SAML Enterprise Application onboarding using Microsoft Graph PowerShell and ClaimsMappingPolicy.

In the Microsoft Entra Admin Center, under Enterprise Applications → SAML-based Sign-on → Attributes & Claims → Add new claim → Transformation, the Contains() transformation is available.

For example, the GUI allows us to configure:

• Transformation: Contains()
• Parameter 1 (Input): user.employeeid
• Value: 123
• Parameter 2 (Output): user.country
• Optional output if no match: user.userprincipalname

This results in logic equivalent to:

IF user.employeeid contains "123"

    THEN output user.country

ELSE

    output user.userprincipalname

We want to create the same transformation programmatically using Microsoft Graph/PowerShell, while continuing to use a Claims Mapping Policy:

New-MgPolicyClaimMappingPolicy

We currently generate a policy containing:

"ClaimsTransformations": [

  {

    "ID": "...",

    "TransformationMethod": "...",

    "InputClaims": [...],

    "InputParameters": [...],

    "OutputClaims": [...]

  }

]

We found Microsoft's SAML claims customization documentation that documents Contains(), but we cannot determine the corresponding Microsoft Graph ClaimsMappingPolicy JSON representation.

Specifically:

1. Is Contains() supported in a Claims Mapping Policy created through Microsoft Graph?
2. If yes, what is the exact ClaimsTransformation JSON structure for Contains()?
3. What are the correct TransformationClaimType values for the input and output?
4. What are the correct InputParameters names and DataType values?
5. How should an attribute output such as user.country be represented?
6. How should the optional "output if no match" attribute be represented?
7. Is the GUI Contains() transformation implemented using a different policy/API model than ClaimsMappingPolicy?
8. If it is not supported through ClaimsMappingPolicy, what Microsoft Graph API should be used to programmatically create the same SAML claim transformation shown in the Entra Admin Center?

We are specifically looking for an official Microsoft-supported Graph API JSON example for this scenario. I was checking this MS link - https://learn.microsoft.com/mt-mt/entra/identity-platform/reference-claims-customization?utm_source=chatgpt.com and I dont see this method available in claim mapping policy.