title: Azure AD Custom Claims in JWT
body: <p>I have an Azure AD app and I am trying to add custom claims to a JWT. I'm using the claims mapping feature in Azure for my specific app, and updated the app manifest in the Azure Portal to include the optional claims. However, when I log in and view the decoded access token, the claim is not present in the token. I haven't found much documentation relating to using extension attributes as claims, but from what I've found it should follow the same patterns, but it is not working as expected. </p>
  
  <p>How do I add a custom claim, sourced from a custom property in the user object in AD, to a JWT when the user logs in?</p>
  
  <p>Thanks in advance!</p>
  
  <h2>Steps to re-create</h2>
  
  <ol>
  <li>Use the Azure AD Graph API to register a directory extension</li>
  </ol>
  
  <p>Request: </p>
  
  <p><code>POST https://graph.windows.net/mytenant.onmicrosoft.com/applications/&lt;application-object-id&gt;/extensionProperties?api-version=1.5</code></p>
  
  <p>Body:</p>
  
  <pre><code>{
     "name": "customUserRoles",
     "dataType": "String",
     "targetObjects": ["User"]
  }
  </code></pre>
  
  <ol start="2">
  <li>Write a value to the extension for a specific AD user</li>
  </ol>
  
  <p>Request:</p>
  
  <p><code>PATCH https://graph.windows.net/mytenant.onmicrosoft.com/users/user123@mytenant.onmicrosoft.com?api-version=1.5</code></p>
  
  <p>Body:</p>
  
  <pre><code>{
     "extension_&lt;appId&gt;_customUserRoles": "My Custom Role 1, Another Role 2"
  }
  </code></pre>
  
  <ol start="3">
  <li>In PowerShell, I installed the Azure AD module: <code>Install-Module -Name AzureADPreview</code></li>
  <li>Create an Azure AD policy</li>
  </ol>
  
  <pre><code>New-AzureADPolicy -Definition @('{"ClaimsMappingPolicy":{"Version": 1, "IncludeBasicClaimSet": "true", "
  ClaimsSchema": [ { "Source": "user", "ID": "extension_&lt;appId&gt;_customUserRoles", "JwtClaimType": "customUserRoles" } ] } }') -DisplayName "customUserRoles" -Type "ClaimsMappingPolicy"
  </code></pre>
  
  <ol start="5">
  <li>Add the policy to the service principal</li>
  </ol>
  
  <pre><code>Add-AzureADServicePrincipalPolicy -Id &lt;service-principla-id&gt; -RefObjectId &lt;azure-ad-policy-id&gt;
  </code></pre>
  
  <ol start="6">
  <li>In the Azure Portal, navigate to Azure AD -> App Registrations -> My App -> Manifest</li>
  <li>Update the following properties</li>
  </ol>
  
  <pre><code>{
     ...
     "acceptMappedClaims: true,
     "optionalClaims": {
        "idToken": [
           {
              "name": "extension_&lt;appId&gt;_customUserRoles",
              "source": "user",
              "essential": false,
           }
        ],
        "accessToken": [
           {
              "name": "extension_&lt;appId&gt;_customUserRoles",
              "source": "user",
              "essential": false,
           }
        ],
        "samlToken": []
     }
  }
  </code></pre>
  
  <ol start="8">
  <li>Save the file</li>
  <li>Navigate to <code>https://login.microsoftonline.com/mytenant.onmicrosoft.com/oauth2/authorize?client_id=&lt;appId&gt;&amp;response_type=token&amp;resource=https://mytenant.sharepoint.com</code> and login with Azure AD user account <code>user123@mytenant.onmicrosoft.com</code></li>
  <li>In the URL, copy the value of the <code>access_token</code> parameter</li>
  <li>Navigate to <code>https://jwt.ms</code> and paste the access token in the text area</li>
  <li>In the decoded token section, the custom claim <em>customUserRoles</em> is <strong>not</strong> present</li>
  </ol>
  
  <p>My expectation is I should see a new claim called <code>customUserRoles</code> or <code>extn.customUserRoles</code> in the decoded token. </p>
  
  <p>What steps am I missing? I haven't gotten any errors throughout this process, but it doesn't appear to be working as the documentation suggests. </p>
  
  <hr>
  
  <h2>Reference Material</h2>
  
  <p>I have read through Microsoft's documentation on these topics:</p>
  
  <p>Optional Claims: <a href="https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-optional-claims" rel="noreferrer">https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-optional-claims</a></p>
  
  <p>Claims Mapping: <a href="https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-claims-mapping" rel="noreferrer">https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-claims-mapping</a></p>
  
  <hr>
  
  <p>I have also read through various forum posts and blog articles relating to this:</p>
  
  <p><a href="https://devonblog.com/cloud/azure-ad-adding-employeeid-claims-in-azure-ad-jwt-token/" rel="noreferrer">https://devonblog.com/cloud/azure-ad-adding-employeeid-claims-in-azure-ad-jwt-token/</a></p>
  
  <p><a href="http://www.redbaronofazure.com/?p=7566" rel="noreferrer">http://www.redbaronofazure.com/?p=7566</a></p>
  
  <p><a href="https://social.msdn.microsoft.com/Forums/en-US/3e5114b6-24d6-4c60-b72b-b4c90baeecac/access-token-missing-optional-claims-that-are-schema-extensions-implicit-grant-flow" rel="noreferrer">https://social.msdn.microsoft.com/Forums/en-US/3e5114b6-24d6-4c60-b72b-b4c90baeecac/access-token-missing-optional-claims-that-are-schema-extensions-implicit-grant-flow</a></p>
  
  <p><a href="https://social.msdn.microsoft.com/Forums/en-US/dbeeed63-8d3f-4c27-b416-431f9fe6c729/providing-directory-extension-optional-claims-and-returning-value-within-token?forum=WindowsAzureAD" rel="noreferrer">https://social.msdn.microsoft.com/Forums/en-US/dbeeed63-8d3f-4c27-b416-431f9fe6c729/providing-directory-extension-optional-claims-and-returning-value-within-token?forum=WindowsAzureAD</a></p>