azure-active-directoryjwt

azp Claim Missing from Azure AD JWT


I have registered an app with Azure AD and can get JWT's but I am receiving claims associated to V1 JWT's according to this whilst I am expecting claims associated to V2 JWT's.

More specifically, I would like to add the azp claim which is only available under V2.

I've followed these instructions to add azp but it is not available to add as an optional claim. I am under the impression that I'm using a version 2 app since the endpoints end with /V2 and I also have the ability to add the ipaddr which is only available for V2 apps as far as I understand.

Can anyone point me to what I am missing?


Solution

  • The version of the access token has nothing to do with the endpoint you use to request the token, but is related to the resource you requested. The default version of ms graph api is the token of version 1.0. If you want to obtain the 2.0 version of the token, you should request your custom api.

    First, you need to create an application that represents the api, and then expose the api protected by Azure.

    enter image description here

    Next,under 'API permissions', give your front-end application access to your backend api:

    enter image description here

    Next, go to the manifest of the front-end application and set the accessTokenAcceptedVersion attribute to: 2.

    enter image description here

    Next, you need to use the auth code flow to obtain an access token,which requires you to log in to the user and obtain the authorization code, and then use the authorization code to redeem the access token.

    enter image description here

    Parse the token, it will display azp claim and v2.0 version.

    enter image description here