title: How to output group claims in B2C from ADFS as an identity provider
body: <p>I'm using ADFS as an IdP for Azure B2C through OpenID Connect. 
  Login works and B2C sends UPN from ADFS as socialIdpUserId claim in JWT token.</p>
  
  <p>But group claims from ADFS do not work. 
  How to receive group claims in JWT?</p>
  
  <p>Here is the setup:
  ADFS claim rule: domain security <strong>groups</strong> and upn
  <a href="https://i.stack.imgur.com/8fEEv.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/8fEEv.png" alt="enter image description here"></a>
  <code>c:[Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname", 
   Issuer == "AD AUTHORITY"] =&gt; 
    issue(store = "Active Directory", 
     types = ("http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn", "http://schemas.xmlsoap.org/claims/Group"), 
     query = ";userPrincipalName,tokenGroups(longDomainQualifiedName);{0}", 
     param = c.Value);
  </code>    </p>
  
  <p>Client permissions are set to openid and allatclaims
  <a href="https://i.stack.imgur.com/6DsmK.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/6DsmK.png" alt="enter image description here"></a></p>
  
  <p>New <strong>group</strong> claim type definition in TrustFrameworkBase policy in ClaimsSchema:</p>
  
  <pre><code>&lt;ClaimsSchema&gt;&lt;ClaimType Id="group"&gt;
      &lt;DisplayName&gt;group&lt;/DisplayName&gt;
      &lt;DataType&gt;string&lt;/DataType&gt;
      &lt;DefaultPartnerClaimTypes&gt;
        &lt;Protocol Name="OAuth2" PartnerClaimType="group" /&gt;
        &lt;Protocol Name="OpenIdConnect" PartnerClaimType="group" /&gt;
        &lt;Protocol Name="SAML2" PartnerClaimType="http://schemas.xmlsoap.org/claims/Group" /&gt;
      &lt;/DefaultPartnerClaimTypes&gt;
    &lt;/ClaimType&gt;&lt;/ClaimsSchema&gt;
  </code></pre>
  
  <p>Output <strong>group</strong> claim definition in TechnicalProfile in TrustFrameworkExtensions policy:</p>
  
  <pre><code>&lt;OutputTokenFormat&gt;JWT&lt;/OutputTokenFormat&gt;&lt;OutputClaims&gt;
            &lt;OutputClaim ClaimTypeReferenceId="socialIdpUserId" PartnerClaimType="UPN" /&gt;
            &lt;OutputClaim ClaimTypeReferenceId="group" PartnerClaimType="group" /&gt;              
          &lt;/OutputClaims&gt;
  </code></pre>
  
  <p>Output <strong>group</strong> claim definition in TechnicalProfile in SignUpOrSignIn policy file</p>
  
  <pre><code>&lt;TechnicalProfile Id="PolicyProfile"&gt;
    &lt;DisplayName&gt;PolicyProfile&lt;/DisplayName&gt;
    &lt;Protocol Name="OpenIdConnect" /&gt;
    &lt;OutputClaims&gt;
      &lt;OutputClaim ClaimTypeReferenceId="socialIdpUserId" /&gt;
      &lt;OutputClaim ClaimTypeReferenceId="group" /&gt;
      &lt;OutputClaim ClaimTypeReferenceId="authmethod" /&gt;
      &lt;OutputClaim ClaimTypeReferenceId="objectId" PartnerClaimType="sub"/&gt;
      &lt;OutputClaim ClaimTypeReferenceId="identityProvider" /&gt;
    &lt;/OutputClaims&gt;
    &lt;SubjectNamingInfo ClaimType="sub" /&gt;
  &lt;/TechnicalProfile&gt;
  </code></pre>
  
  <p>But there is no <strong>group</strong> claim comes with JWT token! Why?</p>