title: How to obtain Azure AD Groups from B2C UserJourney?
body: <p>I'm attempting to retrieve an AAD user's group membership when they log in to my B2C application.  </p>
  
  <p>What I've done:</p>
  
  <ol>
  <li>Followed the procedures outlined in <a href="https://docs.microsoft.com/en-gb/azure/active-directory-b2c/active-directory-b2c-get-started-custom#add-the-application-ids-to-your-custom-policy" rel="nofollow noreferrer">https://docs.microsoft.com/en-gb/azure/active-directory-b2c/active-directory-b2c-get-started-custom#add-the-application-ids-to-your-custom-policy</a></li>
  <li>Created an application in my Azure AD tenant according to the instructions: <a href="https://docs.microsoft.com/en-gb/azure/active-directory-b2c/active-directory-b2c-setup-aad-custom" rel="nofollow noreferrer">https://docs.microsoft.com/en-gb/azure/active-directory-b2c/active-directory-b2c-setup-aad-custom</a></li>
  <li>Modified the manifest of the application to support groups as discussed here -- <a href="https://www.red-gate.com/simple-talk/cloud/security-and-compliance/azure-active-directory-part-4-group-claims/" rel="nofollow noreferrer">https://www.red-gate.com/simple-talk/cloud/security-and-compliance/azure-active-directory-part-4-group-claims/</a></li>
  <li>Created an attribute extension_groups in my B2C tenant for storing the groups (I do not know if this is necessary?)</li>
  <li><p>Added a claimtype to TrustFrameworkBase.xml to support groups:</p>
  
  <p><code>&lt;ClaimType Id="extension_groups"&gt;
                  &lt;DisplayName&gt;Groups&lt;/DisplayName&gt;
                  &lt;DataType&gt;string&lt;/DataType&gt;
                  &lt;DefaultPartnerClaimTypes&gt;
                    &lt;Protocol Name="OAuth2" PartnerClaimType="groups" /&gt;
                    &lt;Protocol Name="OpenIdConnect" PartnerClaimType="groups" /&gt;
                    &lt;Protocol Name="SAML2" PartnerClaimType="http://schemas.microsoft.com/ws/2008/06/identity/claims/groups" /&gt;
                  &lt;/DefaultPartnerClaimTypes&gt;
                  &lt;UserHelpText /&gt;
  &lt;/ClaimType&gt;</code></p></li>
  <li><p>Modified the claims provider in TrustFrameworkExtensions.xml to include the group claim: <code>&lt;OutputClaim ClaimTypeReferenceId="extension_groups" PartnerClaimType="groups"/&gt;</code></p></li>
  <li><p>Modified the output claim in the relyingparty section of my sign-in-only policy:</p>
  
  <p><code>&lt;OutputClaim ClaimTypeReferenceId="extension_groups"/&gt;</code></p></li>
  </ol>
  
  <p>When I sign-in using using an Azure AD account, I get the following error:</p>
  
  <blockquote>
    <p>Sorry, but we're having trouble signing you in. We track these errors
    automatically, but if the problem persists feel free to contact us. In
    the meantime, please try again. Correlation ID:
    e782c5c8-0e08-481b-b2c1-458b3855af7b Timestamp: 2018-04-25 20:07:27Z
    AADB2C: An exception has occured.</p>
  </blockquote>
  
  <p>I'm not even sure where to start -- any tips on exposing the stack trace or hints based on the above config snippets would be amazing.</p>