Share via

get group claim in ID token in Azure AD B2c

dwang 11 Reputation points
2022-05-21T23:54:34.41+00:00

IN azure AD, we can put group claim in ID token through azure AD easily. Do we have similar function to add group claim to ID token in azure AD B2C without custom programming?
Thanks.

Microsoft Entra External ID
Microsoft Entra External ID
A modern identity solution for securing access to customer, citizen and partner-facing apps and services. It is the converged platform of Azure AD External Identities B2B and B2C. Replaces Azure Active Directory External Identities.
2,687 questions
Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
19,950 questions
0 comments

3 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. risolis 8,701 Reputation points
    2022-05-22T00:24:49.113+00:00

    Hello @dwang

    Thank you for your post

    If i understood correctlly your concern, I would give you the next info for you to get it done as shown below:

    https://learn.microsoft.com/en-us/azure/active-directory-b2c/tutorial-create-user-flows?pivots=b2c-user-flow

    Looking forward to your feedback,

    Best Regards,

    Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

  2. dwang 11 Reputation points
    2022-05-22T11:12:41.123+00:00

    hi, based on my experience, group claim without custom programming is available in azure AD, but not in Azure B2c. I wonder what is the reason engineer from Microsoft doesn't know.

  3. AmanpreetSingh-MSFT 56,346 Reputation points
    2022-05-23T14:45:46.59+00:00

    Hi @dwang • Yes, Group Claims are not available out-of-the-box with Azure AD B2C.

    In standard Azure AD tenants, Group Claim can be returned by configuring it Token Configuration blade of the registered application but in Azure AD B2C you cannot do that because the token issuance is handled via IEF so the group claim must be added as an output claims to the user flow or custom policy.

    As of now, there is no option to get the Group claim in the token issued via standard user flows and a custom policy needs to be used for this purpose.

    In order to get the group claim, you need to use Custom Policy that makes the below Graph call via a RESTful Technical Profile to get the user's group membership and return all groups the user belongs to. 

    https://graph.microsoft.com/v1.0/users/aabd55a9-bf43-4838-8246-643d42410f6b/memberOf?$select=displayNamehttps://graph.microsoft.com/v1.0/users/obj_id_of_the_user/memberOf?$select=displayName

    Where the value for obj_id_of_the_user can be provided as an input claim to the RESTful technical profile and this technical profile should be configured to return the group claim as a string collection, which can then be added to the claims bag to be returned in the token issued to the relying party.

    Feel free to tag me in your reply if you have any questions.