azureazure-active-directory

Azure Custom Claim Guest/External User

I am trying to add a custom claim in my JWT Token to distinguish between internal and external users in my Web App.

Thus, I did the following App registrations -> <My application> -> Enterprise Application -> Single sign-on -> Attributes & Claims -> Add new claim -> user.usertype

enter image description here

Unfortunatelly, this doesn't return the Guest value that I was hoping for, when I log in and decode the JWT Token. In my case I get for example UserTypeCloudManaged

Is there maybe another Source attribute with this value? I find it pecurial that this attribute is not already set in the default claims.

Solution

  • I added a custom claim in the Enterprise application:

    enter image description here

    Generated the access token:

    Grant type: Authorization code 

Callback URL: https://oauth.pstmn.io/v1/callback
Auth URL:  https://login.microsoftonline.com/TenantId/oauth2/v2.0/authorize
Token URL : https://login.microsoftonline.com/TenantId/oauth2/v2.0/token
Client ID : ClientID
Client Secret : ClientSecret
Scope: api://XXX/access_as_user

    enter image description here

    And got UserType claim value as UserTypeCloudManaged same as you:

    enter image description here

    Note that: user.usertype is not an exposed attribute value, Refer this MsDoc to check the approved exposed attributes values that can be displayed as claims.

    Hence to resolve the issue, you need to configure claim conditions based on your requirement and save like below:

    enter image description here

    Now I generated access token as member and got claim as "UserType": "Member" :

    enter image description here

    For Guest user, got "UserType": "Guest" :

    enter image description here