title: Problem adding Azure AD user extension to id token claims
body: <p>I'm attempting to follow the <a href="https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-optional-claims" rel="nofollow noreferrer">documentation here</a> to add a user extension to my id token's set of claims, but I can't get it to show up in the token I'm getting.</p>
  
  <p>I've created a user extension in an on-prem AD, and had the value synced with my Azure AD instance.  I verified that the extension was being pushed to Azure AD by looking it up in powershell:</p>
  
  <pre><code>PS U:\&gt; Get-AzureADUserExtension -ObjectId $UserId
  
  Key                                                  Value
  ---                                                  -----
  odata.metadata                                       https://graph.windows.net/84d1aa3c-****-****-****-*****6b7b6ec/...
  odata.type                                           Microsoft.DirectoryServices.User
  createdDateTime                                      1/31/2019 5:55:52 PM
  employeeId
  onPremisesDistinguishedName                          CN=Paul LeBlond,OU=Users,OU=@AR,DC=*********,DC=co
  userIdentities                                       []
  extension_01e6ed59b00**********6ee8e2a025f_pOCCustom customize!
  </code></pre>
  
  <p>According to <a href="https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-optional-claims#configuring-custom-claims-via-directory-extensions" rel="nofollow noreferrer">this part of the documentation</a>, I need to fully qualify the extension with <code>extension_&lt;appid&gt;_&lt;extensionName&gt;</code> and it looks like my sync already did that, although the id shown above doesn't match my appid.  I've tried using the value above, as well as using the appid (with and without dashes) for the middle part, and I've tried just using the extension name (pOCCustom).  None return the claim "extn.POCCustom", which is what I'm expecting.</p>
  
  <p>Here is what the important parts of the application's manifest look like:</p>
  
  <pre><code>    "id": "0d18****-****-****-****-****b28f27f",
      "acceptMappedClaims": null,
      "accessTokenAcceptedVersion": null,
      "allowPublicClient": null,
      "appId": "b4d8****-****-****-****-****234311bd",
  ...
      "optionalClaims": {
          "idToken": [
              {
                  "name": "extension_01e6ed59b00**********6ee8e2a025f_pOCCustom",
                  "source": "user",
                  "essential": false,
                  "additionalProperties": []
              },
              {
                  "name": "family_name",
                  "source": null,
                  "essential": false,
                  "additionalProperties": []
              },
              {
                  "name": "given_name",
                  "source": null,
                  "essential": false,
                  "additionalProperties": []
              }
          ],
          "accessToken": [],
          "saml2Token": []
      },
  </code></pre>
  
  <p>I added the family_name and given_name to make sure I was at least close, and those have been included in my id token as expected.</p>
  
  <p>And here is what my idToken looks like when I sign in:</p>
  
  <pre><code>{
    "displayableId": "paul@********",
    "name": "Paul LeBlond",
    "identityProvider": "https://login.microsoftonline.com/***/v2.0",
    "userIdentifier": "N2******iNmVj",
    "idToken": {
      "aud": "b4d8****-****-****-****-****234311bd",
      "iss": "https://login.microsoftonline.com/84d1aa3c-****-****-****-*****6b7b6ec/v2.0",
      "iat": 1550157932,
      "nbf": 1550157932,
      "exp": 1550161832,
      "aio": "ATQ******C9bTV+",
      "family_name": "LeBlond",
      "given_name": "Paul",
      "name": "Paul LeBlond",
      "nonce": "a0c13***06",
      "oid": "7ad8**4d75d7e0",
      "preferred_username": "paul@*****",
      "roles": [
        "CanAccess"
      ],
      "sub": "Ko1***K6RMiTrLQAJUI",
      "tid": "84d1aa***e16b7b6ec",
      "uti": "gZ8q****psxrtMAQ",
      "ver": "2.0"
    }
  }
  </code></pre>
  
  <p>So I'm getting my family_name and given_name claims, but not my POCCustom claim.  What do I need to do to get that user extension to show up in my id token?</p>