azureazure-active-directoryclaimsazure-entra-id

How to add custom claims to Azure AD users

I am developing a web application that uses Microsoft Azure AD (Entra) as identity server for single sign-in. So I have users defined in Azure AD.

Now I want to add additional properties or claims to each user, ie. I want to add these two claims to each user: claim(property)Name = ExternalServiceUserId claim(property)Name = ExternalServicePassword

So then I can add those informations in the Azure Portal to each user, and get them in my application by using Microsoft Graph API.

IE. lets say that I have two users (User1, User2): So I want to be able to add:

User1.ExternalServiceUserId = "someUserId"
User1.ExternalServicePAssword= "somePassword"

User2.ExternalServiceUserId = "someUserId2"
User2.ExternalServicePAssword= "somePassword2"

And I want to add these properties and their values through the Azure portal.

How to do so?

Solution

  • Note that: AFAIK there is no way to create or assign custom claims to the user via Azure Portal.

    You can create extensions for the application using Microsoft Graph API or PowerShell:

    POST https://graph.microsoft.com/v1.0/applications/appObjID/extensionProperties
Content-type: application/json

{
    "name": "ExternalServiceUserId",
    "dataType": "String",
    "targetObjects": [
        "User"
    ]
}

    enter image description here

    Assign the value to the user:

    PATCH https://graph.microsoft.com/v1.0/users/UPN
Content-type: application/json

{
  "extension_XXX_ExternalServiceUserId": "333333"
}

    enter image description here

    Do the same with ExternalServicePAssword and assign to the user:

    PATCH https://graph.microsoft.com/v1.0/users/UPN
Content-type: application/json

{
  "extension_XXX_ExternalServicePAssword": "XXX"
}

    enter image description here

    Do the same with other user and assign the values to the User2.

    Now configure optional claims in the application:

    enter image description here

    For sample, I generated access token via Postman:

    Grant type: Authorization code 

Callback URL: https://oauth.pstmn.io/v1/callback
Auth URL:  https://login.microsoftonline.com/TenantId/oauth2/v2.0/authorize
Token URL : https://login.microsoftonline.com/TenantId/oauth2/v2.0/token
Client ID : ClientId
Client Secret : ClientSecret
Scope: api://ClientID/Claims.Read

    enter image description here

    enter image description here

    When I decoded the access token, I am able to get the custom claims successfully:

    enter image description here