title: Why are claims being flagged as not supported in my custom policy?
body: <p>I'm switching our app from using built-in user flows to custom policies so that we can enable some features that we need like account linking and REST integration.</p>
  
  <p>My TrustFrameworkBase.xml and TrustFrameworkExtensions.xml policy files both upload fine.  But when I try uploading the relying party file I'm hitting a validation error that I can't explain:</p>
  
  <blockquote>
    <p>Validation failed: 2 validation error(s) found in policy "B2C_1A_SIGNUP" of tenant "HyperProofLocalDev.onmicrosoft.com".Input Claim 'alternativeSecurityIds' is not supported in Azure Active Directory Provider technical profile 'AAD-UserWriteUsingAlternativeSecurityId' of policy 'B2C_1A_SignUp'.Input Claim 'emails' is not supported in Azure Active Directory Provider technical profile 'AAD-UserCreateEmailsClaim' of policy 'B2C_1A_SignUp'.</p>
  </blockquote>
  
  <p>I followed guidance online such as <a href="https://stackoverflow.com/questions/46778129/azure-ad-b2c-emails-claim-in-custom-policy">this post</a> to add support for these claims.  Haven't been able to determine why B2C thinks these are unsupported.</p>
  
  <p>Here's what I have for <code>emails</code> in TrustFrameworkBase.xml:</p>
  
  <pre><code>      &lt;ClaimType Id="emails"&gt;
          &lt;DisplayName&gt;Emails&lt;/DisplayName&gt;
          &lt;DataType&gt;stringCollection&lt;/DataType&gt;
          &lt;UserHelpText&gt;User's email addresses&lt;/UserHelpText&gt;
        &lt;/ClaimType&gt;
  </code></pre>
  
  <pre><code>      &lt;ClaimsTransformation Id="GetFirstOtherMail" TransformationMethod="GetSingleItemFromStringCollection"&gt;
          &lt;InputClaims&gt;
            &lt;InputClaim ClaimTypeReferenceId="otherMails" TransformationClaimType="collection" /&gt;
          &lt;/InputClaims&gt;
          &lt;OutputClaims&gt;
            &lt;OutputClaim ClaimTypeReferenceId="firstOtherMail" TransformationClaimType="extractedItem" /&gt;
          &lt;/OutputClaims&gt;
        &lt;/ClaimsTransformation&gt;
  
        &lt;ClaimsTransformation Id="CopyFirstOtherMailToEmails" TransformationMethod="AddItemToStringCollection"&gt;
          &lt;InputClaims&gt;
            &lt;InputClaim ClaimTypeReferenceId="firstOtherMail" TransformationClaimType="item" /&gt;
            &lt;InputClaim ClaimTypeReferenceId="emails" TransformationClaimType="collection" /&gt;
          &lt;/InputClaims&gt;
          &lt;OutputClaims&gt;
            &lt;OutputClaim ClaimTypeReferenceId="emails" TransformationClaimType="collection" /&gt;
          &lt;/OutputClaims&gt;
        &lt;/ClaimsTransformation&gt;
  
        &lt;ClaimsTransformation Id="CopySignInNamesEmailToEmails" TransformationMethod="AddItemToStringCollection"&gt;
          &lt;InputClaims&gt;
            &lt;InputClaim ClaimTypeReferenceId="signInNames.emailAddress" TransformationClaimType="item" /&gt;
            &lt;InputClaim ClaimTypeReferenceId="emails" TransformationClaimType="collection" /&gt;
          &lt;/InputClaims&gt;
          &lt;OutputClaims&gt;
            &lt;OutputClaim ClaimTypeReferenceId="emails" TransformationClaimType="collection" /&gt;
          &lt;/OutputClaims&gt;
        &lt;/ClaimsTransformation&gt;
  </code></pre>
  
  <pre><code>        &lt;TechnicalProfile Id="AAD-UserCreateEmailsClaim"&gt;
            &lt;Metadata&gt;
              &lt;Item Key="Operation"&gt;Read&lt;/Item&gt;
              &lt;Item Key="RaiseErrorIfClaimsPrincipalDoesNotExist"&gt;true&lt;/Item&gt;
            &lt;/Metadata&gt;
            &lt;IncludeInSso&gt;false&lt;/IncludeInSso&gt;
            &lt;InputClaims&gt;
              &lt;InputClaim ClaimTypeReferenceId="objectId" Required="true" /&gt;
            &lt;/InputClaims&gt;
            &lt;OutputClaims&gt;
              &lt;OutputClaim ClaimTypeReferenceId="emails" /&gt;           
            &lt;/OutputClaims&gt;
            &lt;OutputClaimsTransformations&gt;
              &lt;OutputClaimsTransformation ReferenceId="GetFirstOtherMail"/&gt;
              &lt;OutputClaimsTransformation ReferenceId="CopySignInNamesEmailToEmails"/&gt;
              &lt;OutputClaimsTransformation ReferenceId="CopyFirstOtherMailToEmails"/&gt;
            &lt;/OutputClaimsTransformations&gt;
            &lt;IncludeTechnicalProfile ReferenceId="AAD-Common" /&gt;
          &lt;/TechnicalProfile&gt;
  
  </code></pre>
  
  <p>And here's the relying party file:</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8" standalone="yes"?&gt;
  &lt;TrustFrameworkPolicy
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xmlns:xsd="http://www.w3.org/2001/XMLSchema"
    xmlns="http://schemas.microsoft.com/online/cpim/schemas/2013/06"
    PolicySchemaVersion="0.3.0.0"
    TenantId="hyperprooflocaldev.onmicrosoft.com"
    PolicyId="B2C_1A_SignUp"
    PublicPolicyUri="http://hyperprooflocaldev.onmicrosoft.com/B2C_1A_SignUp"  
    DeploymentMode="Development"
    UserJourneyRecorderEndpoint="urn:journeyrecorder:applicationinsights"
    &gt;
  
    &lt;BasePolicy&gt;
      &lt;TenantId&gt;hyperprooflocaldev.onmicrosoft.com&lt;/TenantId&gt;
      &lt;PolicyId&gt;B2C_1A_TrustFrameworkExtensions&lt;/PolicyId&gt;
    &lt;/BasePolicy&gt;
  
    &lt;RelyingParty&gt;
      &lt;DefaultUserJourney ReferenceId="SignUp" /&gt;
      &lt;UserJourneyBehaviors&gt;
        &lt;SessionExpiryType&gt;Rolling&lt;/SessionExpiryType&gt;
        &lt;SessionExpiryInSeconds&gt;86400&lt;/SessionExpiryInSeconds&gt;
        &lt;JourneyInsights TelemetryEngine="ApplicationInsights" InstrumentationKey="451d3a92-fb38-4a1b-9b77-2f6572677090" DeveloperMode="true" ClientEnabled="false" ServerEnabled="true" TelemetryVersion="1.0.0" /&gt;
        &lt;ContentDefinitionParameters&gt;
          &lt;Parameter Name="emailAddress"&gt;{OIDC:LoginHint}&lt;/Parameter&gt;
          &lt;Parameter Name="givenName"&gt;{OAUTH-KV:givenName}&lt;/Parameter&gt;
          &lt;Parameter Name="surname"&gt;{OAUTH-KV:surname}&lt;/Parameter&gt;
        &lt;/ContentDefinitionParameters&gt;
        &lt;ScriptExecution&gt;Allow&lt;/ScriptExecution&gt;
      &lt;/UserJourneyBehaviors&gt;    
  
      &lt;TechnicalProfile Id="PolicyProfile"&gt;
        &lt;DisplayName&gt;PolicyProfile&lt;/DisplayName&gt;
        &lt;Protocol Name="OpenIdConnect" /&gt;
        &lt;OutputClaims&gt;
          &lt;OutputClaim ClaimTypeReferenceId="displayName" /&gt;
          &lt;OutputClaim ClaimTypeReferenceId="email" /&gt;
          &lt;OutputClaim ClaimTypeReferenceId="emails" /&gt;
          &lt;OutputClaim ClaimTypeReferenceId="givenName" /&gt;
          &lt;OutputClaim ClaimTypeReferenceId="identityProvider" /&gt;
          &lt;OutputClaim ClaimTypeReferenceId="surname" /&gt;
          &lt;OutputClaim ClaimTypeReferenceId="newUser" /&gt;
          &lt;OutputClaim ClaimTypeReferenceId="objectId" /&gt;
          &lt;OutputClaim ClaimTypeReferenceId="objectId" PartnerClaimType="sub" /&gt;
          &lt;OutputClaim ClaimTypeReferenceId="trustFrameworkPolicy" Required="true" DefaultValue="{policy}" /&gt;
        &lt;/OutputClaims&gt;
        &lt;SubjectNamingInfo ClaimType="sub" /&gt;
      &lt;/TechnicalProfile&gt;
    &lt;/RelyingParty&gt;
  &lt;/TrustFrameworkPolicy&gt;
  
  </code></pre>