title: Custom policy in Azure AD B2C does not allow to save empty string for attribute
body: <p>We have custom edit profile policy, which is based on the example provided by Microsoft, the policy has Company and Phone claims, which are not required.
  When Company or Phone claim is left blank it still contains an old value after the profile is saved.</p>
  
  <p>We have found, that there is a setting ConvertEmptyClaimsToNull, which is true by default, also we have tried <a href="https://docs.microsoft.com/en-us/azure/active-directory-b2c/string-transformations#nullclaim" rel="nofollow noreferrer">https://docs.microsoft.com/en-us/azure/active-directory-b2c/string-transformations#nullclaim</a>, but this did not help.</p>
  
  <p>Edit profile policy:</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8" standalone="yes"?&gt;
  &lt;TrustFrameworkPolicy
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xmlns:xsd="http://www.w3.org/2001/XMLSchema"
    xmlns="http://schemas.microsoft.com/online/cpim/schemas/2013/06"
    PolicySchemaVersion="0.3.0.0"
    TenantId=""
    PolicyId=""
    PublicPolicyUri=""&gt;
  
    &lt;BasePolicy&gt;
      &lt;TenantId&gt;&lt;/TenantId&gt;
      &lt;PolicyId&gt;&lt;/PolicyId&gt;
    &lt;/BasePolicy&gt;
  
    &lt;RelyingParty&gt;
      &lt;DefaultUserJourney ReferenceId="ProfileEdit" /&gt;
      &lt;TechnicalProfile Id="PolicyProfile"&gt;
        &lt;DisplayName&gt;PolicyProfile&lt;/DisplayName&gt;
        &lt;Protocol Name="OpenIdConnect" /&gt;
        &lt;OutputClaims&gt;
          &lt;OutputClaim ClaimTypeReferenceId="objectId" PartnerClaimType="sub"/&gt;
          &lt;OutputClaim ClaimTypeReferenceId="tenantId" AlwaysUseDefaultValue="true" DefaultValue="{Policy:TenantObjectId}" /&gt;
  
          &lt;OutputClaim ClaimTypeReferenceId="givenName" /&gt;
          &lt;OutputClaim ClaimTypeReferenceId="surname" /&gt;
          &lt;OutputClaim ClaimTypeReferenceId="email" /&gt;
  
          &lt;OutputClaim ClaimTypeReferenceId="country" /&gt;
          &lt;OutputClaim ClaimTypeReferenceId="city" /&gt;
          &lt;OutputClaim ClaimTypeReferenceId="extension_Company" /&gt;
          &lt;OutputClaim ClaimTypeReferenceId="extension_Phone" /&gt;
          &lt;OutputClaim ClaimTypeReferenceId="extension_MarketingConsent" /&gt;
        &lt;/OutputClaims&gt;
        &lt;SubjectNamingInfo ClaimType="sub" /&gt;
      &lt;/TechnicalProfile&gt;
    &lt;/RelyingParty&gt;
  &lt;/TrustFrameworkPolicy&gt;
  </code></pre>
  
  <p>TrustFrameworkBase:</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8" standalone="yes"?&gt;
  &lt;TrustFrameworkPolicy
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xmlns:xsd="http://www.w3.org/2001/XMLSchema"
    xmlns="http://schemas.microsoft.com/online/cpim/schemas/2013/06"
    PolicySchemaVersion="0.3.0.0"
    TenantId=""
    PolicyId="B2C_1A_TrustFrameworkBase"
    PublicPolicyUri=""&gt;
  
    &lt;ClaimsProviders&gt;
      &lt;ClaimsProvider&gt;
        &lt;DisplayName&gt;Local Account SignIn&lt;/DisplayName&gt;
        &lt;TechnicalProfiles&gt;
          &lt;TechnicalProfile Id="login-NonInteractive"&gt;
            &lt;DisplayName&gt;Local Account SignIn&lt;/DisplayName&gt;
            &lt;Protocol Name="OpenIdConnect" /&gt;
            &lt;Metadata&gt;
              &lt;Item Key="UserMessageIfClaimsPrincipalDoesNotExist"&gt;We can't seem to find your account&lt;/Item&gt;
              &lt;Item Key="UserMessageIfInvalidPassword"&gt;Your password is incorrect&lt;/Item&gt;
              &lt;Item Key="UserMessageIfOldPasswordUsed"&gt;Looks like you used an old password&lt;/Item&gt;
              &lt;Item Key="ProviderName"&gt;https://sts.windows.net/&lt;/Item&gt;
              &lt;Item Key="METADATA"&gt;https://login.microsoftonline.com/{tenant}/.well-known/openid-configuration&lt;/Item&gt;
              &lt;Item Key="authorization_endpoint"&gt;https://login.microsoftonline.com/{tenant}/oauth2/token&lt;/Item&gt;
              &lt;Item Key="response_types"&gt;id_token&lt;/Item&gt;
              &lt;Item Key="response_mode"&gt;query&lt;/Item&gt;
              &lt;Item Key="scope"&gt;email openid&lt;/Item&gt;
              &lt;!-- Policy Engine Clients --&gt;
              &lt;Item Key="UsePolicyInRedirectUri"&gt;false&lt;/Item&gt;
              &lt;Item Key="HttpBinding"&gt;POST&lt;/Item&gt;
            &lt;/Metadata&gt;
            &lt;InputClaims&gt;
              &lt;InputClaim ClaimTypeReferenceId="email" PartnerClaimType="username" Required="true" /&gt;
              &lt;InputClaim ClaimTypeReferenceId="password" Required="true" /&gt;
              &lt;InputClaim ClaimTypeReferenceId="grant_type" DefaultValue="password" /&gt;
              &lt;InputClaim ClaimTypeReferenceId="scope" DefaultValue="openid" /&gt;
              &lt;InputClaim ClaimTypeReferenceId="nca" PartnerClaimType="nca" DefaultValue="1" /&gt;
            &lt;/InputClaims&gt;
            &lt;OutputClaims&gt;
              &lt;OutputClaim ClaimTypeReferenceId="objectId" PartnerClaimType="oid" /&gt;
              &lt;OutputClaim ClaimTypeReferenceId="tenantId" PartnerClaimType="tid" /&gt;
              &lt;OutputClaim ClaimTypeReferenceId="givenName" PartnerClaimType="given_name" /&gt;
              &lt;OutputClaim ClaimTypeReferenceId="surName" PartnerClaimType="family_name" /&gt;
              &lt;OutputClaim ClaimTypeReferenceId="displayName" PartnerClaimType="name" /&gt;
              &lt;OutputClaim ClaimTypeReferenceId="userPrincipalName" PartnerClaimType="upn" /&gt;
              &lt;OutputClaim ClaimTypeReferenceId="authenticationSource" DefaultValue="localAccountAuthentication" /&gt;
  
              &lt;OutputClaim ClaimTypeReferenceId="country" PartnerClaimType="country" /&gt;
              &lt;OutputClaim ClaimTypeReferenceId="city" PartnerClaimType="city" /&gt;
              &lt;OutputClaim ClaimTypeReferenceId="extension_Company" PartnerClaimType="extension_Company" /&gt;
              &lt;OutputClaim ClaimTypeReferenceId="extension_Phone"  PartnerClaimType="extension_Phone" /&gt;
              &lt;OutputClaim ClaimTypeReferenceId="extension_MarketingConsent" PartnerClaimType="extension_MarketingConsent" /&gt;
            &lt;/OutputClaims&gt;
          &lt;/TechnicalProfile&gt;
        &lt;/TechnicalProfiles&gt;
      &lt;/ClaimsProvider&gt;
      &lt;ClaimsProvider&gt;
        &lt;DisplayName&gt;Azure Active Directory&lt;/DisplayName&gt;
        &lt;TechnicalProfiles&gt;
          &lt;TechnicalProfile Id="AAD-Common"&gt;
            &lt;DisplayName&gt;Azure Active Directory&lt;/DisplayName&gt;
            &lt;Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.AzureActiveDirectoryProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" /&gt;
            &lt;Metadata&gt;
              &lt;Item Key="ApplicationObjectId"&gt;831fb406-f72d-4a18-b45c-325c87791ed0&lt;/Item&gt;
              &lt;Item Key="ClientId"&gt;bfde7a7f-c0a1-417e-b609-4e1d598881ef&lt;/Item&gt;
            &lt;/Metadata&gt;
            &lt;CryptographicKeys&gt;
              &lt;Key Id="issuer_secret" StorageReferenceId="B2C_1A_TokenSigningKeyContainer" /&gt;
            &lt;/CryptographicKeys&gt;
            &lt;!-- We need this here to suppress the SelfAsserted provider from invoking SSO on validation profiles. --&gt;
            &lt;IncludeInSso&gt;false&lt;/IncludeInSso&gt;
            &lt;UseTechnicalProfileForSessionManagement ReferenceId="SM-Noop" /&gt;
          &lt;/TechnicalProfile&gt;
          &lt;!-- Technical profiles for local accounts --&gt;
          &lt;TechnicalProfile Id="AAD-UserWriteUsingLogonEmail"&gt;
            &lt;Metadata&gt;
              &lt;Item Key="Operation"&gt;Write&lt;/Item&gt;
              &lt;Item Key="RaiseErrorIfClaimsPrincipalAlreadyExists"&gt;true&lt;/Item&gt;
            &lt;/Metadata&gt;
            &lt;IncludeInSso&gt;false&lt;/IncludeInSso&gt;
            &lt;InputClaims&gt;
              &lt;InputClaim ClaimTypeReferenceId="email" PartnerClaimType="signInNames.emailAddress" Required="true" /&gt;
            &lt;/InputClaims&gt;
            &lt;PersistedClaims&gt;
              &lt;!-- Required claims --&gt;
              &lt;PersistedClaim ClaimTypeReferenceId="email" PartnerClaimType="signInNames.emailAddress" /&gt;
              &lt;PersistedClaim ClaimTypeReferenceId="newPassword" PartnerClaimType="password" /&gt;
              &lt;PersistedClaim ClaimTypeReferenceId="displayName" DefaultValue="unknown" /&gt;
              &lt;PersistedClaim ClaimTypeReferenceId="passwordPolicies" DefaultValue="DisablePasswordExpiration" /&gt;
              &lt;!-- Optional claims. --&gt;
              &lt;PersistedClaim ClaimTypeReferenceId="givenName" /&gt;
              &lt;PersistedClaim ClaimTypeReferenceId="surname" /&gt;
  
              &lt;PersistedClaim ClaimTypeReferenceId="country" /&gt;
              &lt;PersistedClaim ClaimTypeReferenceId="city" /&gt;
              &lt;PersistedClaim ClaimTypeReferenceId="extension_Company" /&gt;
              &lt;PersistedClaim ClaimTypeReferenceId="extension_Phone" /&gt;
              &lt;PersistedClaim ClaimTypeReferenceId="extension_MarketingConsent" /&gt;
            &lt;/PersistedClaims&gt;
            &lt;OutputClaims&gt;
              &lt;OutputClaim ClaimTypeReferenceId="objectId" /&gt;
              &lt;OutputClaim ClaimTypeReferenceId="newUser" PartnerClaimType="newClaimsPrincipalCreated" /&gt;
              &lt;OutputClaim ClaimTypeReferenceId="authenticationSource" DefaultValue="localAccountAuthentication" /&gt;
              &lt;OutputClaim ClaimTypeReferenceId="userPrincipalName" /&gt;
              &lt;OutputClaim ClaimTypeReferenceId="signInNames.emailAddress" /&gt;
            &lt;/OutputClaims&gt;
            &lt;IncludeTechnicalProfile ReferenceId="AAD-Common" /&gt;
            &lt;UseTechnicalProfileForSessionManagement ReferenceId="SM-AAD" /&gt;
          &lt;/TechnicalProfile&gt;
          &lt;TechnicalProfile Id="AAD-UserReadUsingEmailAddress"&gt;
            &lt;Metadata&gt;
              &lt;Item Key="Operation"&gt;Read&lt;/Item&gt;
              &lt;Item Key="RaiseErrorIfClaimsPrincipalDoesNotExist"&gt;true&lt;/Item&gt;
              &lt;Item Key="UserMessageIfClaimsPrincipalDoesNotExist"&gt;An account could not be found for the provided user ID.&lt;/Item&gt;
            &lt;/Metadata&gt;
            &lt;IncludeInSso&gt;false&lt;/IncludeInSso&gt;
            &lt;InputClaims&gt;
              &lt;InputClaim ClaimTypeReferenceId="email" PartnerClaimType="signInNames.emailAddress" Required="true" /&gt;
            &lt;/InputClaims&gt;
            &lt;OutputClaims&gt;
              &lt;!-- Required claims --&gt;
              &lt;OutputClaim ClaimTypeReferenceId="objectId" /&gt;
              &lt;OutputClaim ClaimTypeReferenceId="authenticationSource" DefaultValue="localAccountAuthentication" /&gt;
              &lt;!-- Optional claims --&gt;
              &lt;OutputClaim ClaimTypeReferenceId="userPrincipalName" /&gt;
              &lt;OutputClaim ClaimTypeReferenceId="displayName" /&gt;
              &lt;OutputClaim ClaimTypeReferenceId="accountEnabled" /&gt;
              &lt;OutputClaim ClaimTypeReferenceId="otherMails" /&gt;
              &lt;OutputClaim ClaimTypeReferenceId="signInNames.emailAddress" /&gt;
  
              &lt;OutputClaim ClaimTypeReferenceId="country" /&gt;
              &lt;OutputClaim ClaimTypeReferenceId="city" /&gt;
              &lt;OutputClaim ClaimTypeReferenceId="extension_Company" /&gt;
              &lt;OutputClaim ClaimTypeReferenceId="extension_Phone" /&gt;
              &lt;OutputClaim ClaimTypeReferenceId="extension_MarketingConsent" /&gt;
            &lt;/OutputClaims&gt;
            &lt;OutputClaimsTransformations&gt;
              &lt;OutputClaimsTransformation ReferenceId="AssertAccountEnabledIsTrue" /&gt;
            &lt;/OutputClaimsTransformations&gt;
            &lt;IncludeTechnicalProfile ReferenceId="AAD-Common" /&gt;
          &lt;/TechnicalProfile&gt;
          &lt;TechnicalProfile Id="AAD-UserWritePasswordUsingObjectId"&gt;
            &lt;Metadata&gt;
              &lt;Item Key="Operation"&gt;Write&lt;/Item&gt;
              &lt;Item Key="RaiseErrorIfClaimsPrincipalDoesNotExist"&gt;true&lt;/Item&gt;
            &lt;/Metadata&gt;
            &lt;IncludeInSso&gt;false&lt;/IncludeInSso&gt;
            &lt;InputClaims&gt;
              &lt;InputClaim ClaimTypeReferenceId="objectId" Required="true" /&gt;
            &lt;/InputClaims&gt;
            &lt;PersistedClaims&gt;
              &lt;PersistedClaim ClaimTypeReferenceId="objectId" /&gt;
              &lt;PersistedClaim ClaimTypeReferenceId="newPassword" PartnerClaimType="password" /&gt;
            &lt;/PersistedClaims&gt;
            &lt;IncludeTechnicalProfile ReferenceId="AAD-Common" /&gt;
          &lt;/TechnicalProfile&gt;
          &lt;!-- Technical profiles for updating user record using objectId --&gt;
          &lt;TechnicalProfile Id="AAD-UserWriteProfileUsingObjectId"&gt;
            &lt;Metadata&gt;
              &lt;Item Key="Operation"&gt;Write&lt;/Item&gt;
              &lt;Item Key="RaiseErrorIfClaimsPrincipalAlreadyExists"&gt;false&lt;/Item&gt;
              &lt;Item Key="RaiseErrorIfClaimsPrincipalDoesNotExist"&gt;true&lt;/Item&gt;
            &lt;/Metadata&gt;
            &lt;IncludeInSso&gt;false&lt;/IncludeInSso&gt;
            &lt;InputClaims&gt;
              &lt;InputClaim ClaimTypeReferenceId="objectId" Required="true" /&gt;
            &lt;/InputClaims&gt;
            &lt;PersistedClaims&gt;
              &lt;!-- Required claims --&gt;
              &lt;PersistedClaim ClaimTypeReferenceId="objectId" /&gt;
              &lt;!-- Optional claims --&gt;
              &lt;PersistedClaim ClaimTypeReferenceId="givenName" /&gt;
              &lt;PersistedClaim ClaimTypeReferenceId="surname" /&gt;
  
              &lt;PersistedClaim ClaimTypeReferenceId="country" /&gt;
              &lt;PersistedClaim ClaimTypeReferenceId="city" /&gt;
              &lt;PersistedClaim ClaimTypeReferenceId="extension_Company" /&gt;
              &lt;PersistedClaim ClaimTypeReferenceId="extension_Phone" /&gt;
              &lt;PersistedClaim ClaimTypeReferenceId="extension_MarketingConsent" /&gt;
            &lt;/PersistedClaims&gt;
            &lt;IncludeTechnicalProfile ReferenceId="AAD-Common" /&gt;
          &lt;/TechnicalProfile&gt;
          &lt;!-- The following technical profile is used to read data after user authenticates. --&gt;
          &lt;TechnicalProfile Id="AAD-UserReadUsingObjectId"&gt;
            &lt;Metadata&gt;
              &lt;Item Key="Operation"&gt;Read&lt;/Item&gt;
              &lt;Item Key="RaiseErrorIfClaimsPrincipalDoesNotExist"&gt;true&lt;/Item&gt;
            &lt;/Metadata&gt;
            &lt;IncludeInSso&gt;false&lt;/IncludeInSso&gt;
            &lt;InputClaims&gt;
              &lt;InputClaim ClaimTypeReferenceId="objectId" Required="true" /&gt;
            &lt;/InputClaims&gt;
            &lt;OutputClaims&gt;
              &lt;!-- Optional claims --&gt;
              &lt;OutputClaim ClaimTypeReferenceId="signInNames.emailAddress" /&gt;
              &lt;OutputClaim ClaimTypeReferenceId="displayName" /&gt;
              &lt;OutputClaim ClaimTypeReferenceId="otherMails" /&gt;
              &lt;OutputClaim ClaimTypeReferenceId="givenName" /&gt;
              &lt;OutputClaim ClaimTypeReferenceId="surname" /&gt;
  
              &lt;OutputClaim ClaimTypeReferenceId="country" /&gt;
              &lt;OutputClaim ClaimTypeReferenceId="city" /&gt;
              &lt;OutputClaim ClaimTypeReferenceId="extension_Company" /&gt;
              &lt;OutputClaim ClaimTypeReferenceId="extension_Phone" /&gt;
              &lt;OutputClaim ClaimTypeReferenceId="extension_MarketingConsent" /&gt;
            &lt;/OutputClaims&gt;
            &lt;IncludeTechnicalProfile ReferenceId="AAD-Common" /&gt;
          &lt;/TechnicalProfile&gt;
        &lt;/TechnicalProfiles&gt;
      &lt;/ClaimsProvider&gt;
      &lt;ClaimsProvider&gt;
        &lt;DisplayName&gt;Self Asserted&lt;/DisplayName&gt;
        &lt;TechnicalProfiles&gt;
          &lt;TechnicalProfile Id="SelfAsserted-ProfileUpdate"&gt;
            &lt;DisplayName&gt;User ID signup&lt;/DisplayName&gt;
            &lt;Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.SelfAssertedAttributeProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" /&gt;
            &lt;Metadata&gt;
              &lt;Item Key="ContentDefinitionReferenceId"&gt;api.selfasserted.profileupdate&lt;/Item&gt;
            &lt;/Metadata&gt;
            &lt;IncludeInSso&gt;false&lt;/IncludeInSso&gt;
            &lt;InputClaims&gt;
              &lt;InputClaim ClaimTypeReferenceId="userPrincipalName" /&gt;
              &lt;!-- Optional claims. These claims are collected from the user and can be modified. Any claim added here should be updated in the
                   ValidationTechnicalProfile referenced below so it can be written to directory after being updateed by the user, i.e. AAD-UserWriteProfileUsingObjectId. --&gt;
              &lt;InputClaim ClaimTypeReferenceId="givenName" /&gt;
              &lt;InputClaim ClaimTypeReferenceId="surname" /&gt;
  
              &lt;InputClaim ClaimTypeReferenceId="country" /&gt;
              &lt;InputClaim ClaimTypeReferenceId="city" /&gt;
              &lt;InputClaim ClaimTypeReferenceId="extension_Company" /&gt;
              &lt;InputClaim ClaimTypeReferenceId="extension_Phone" /&gt;
              &lt;InputClaim ClaimTypeReferenceId="extension_MarketingConsent" /&gt;
            &lt;/InputClaims&gt;
            &lt;OutputClaims&gt;
              &lt;!-- Required claims --&gt;
              &lt;OutputClaim ClaimTypeReferenceId="executed-SelfAsserted-Input" DefaultValue="true" /&gt;
              &lt;!-- Optional claims. These claims are collected from the user and can be modified. Any claim added here should be updated in the
                   ValidationTechnicalProfile referenced below so it can be written to directory after being updateed by the user, i.e. AAD-UserWriteProfileUsingObjectId. --&gt;
              &lt;OutputClaim ClaimTypeReferenceId="givenName" Required="true" /&gt;
              &lt;OutputClaim ClaimTypeReferenceId="surName" Required="true" /&gt;
  
              &lt;OutputClaim ClaimTypeReferenceId="country" Required="true"/&gt;
              &lt;OutputClaim ClaimTypeReferenceId="city" Required="true" /&gt;
              &lt;OutputClaim ClaimTypeReferenceId="extension_Company" /&gt;
              &lt;OutputClaim ClaimTypeReferenceId="extension_Phone" /&gt;
              &lt;OutputClaim ClaimTypeReferenceId="extension_MarketingConsent" /&gt;
            &lt;/OutputClaims&gt;
            &lt;ValidationTechnicalProfiles&gt;
              &lt;ValidationTechnicalProfile ReferenceId="AAD-UserWriteProfileUsingObjectId" /&gt;
            &lt;/ValidationTechnicalProfiles&gt;
          &lt;/TechnicalProfile&gt;
        &lt;/TechnicalProfiles&gt;
      &lt;/ClaimsProvider&gt;
      &lt;ClaimsProvider&gt;
        &lt;DisplayName&gt;Local Account&lt;/DisplayName&gt;
        &lt;TechnicalProfiles&gt;
          &lt;TechnicalProfile Id="LocalAccountSignUpWithLogonEmail"&gt;
            &lt;DisplayName&gt;Email signup&lt;/DisplayName&gt;
            &lt;Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.SelfAssertedAttributeProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" /&gt;
            &lt;Metadata&gt;
              &lt;Item Key="IpAddressClaimReferenceId"&gt;IpAddress&lt;/Item&gt;
              &lt;Item Key="ContentDefinitionReferenceId"&gt;api.localaccountsignup&lt;/Item&gt;
              &lt;Item Key="language.button_continue"&gt;Create&lt;/Item&gt;
            &lt;/Metadata&gt;
            &lt;CryptographicKeys&gt;
              &lt;Key Id="issuer_secret" StorageReferenceId="B2C_1A_TokenSigningKeyContainer" /&gt;
            &lt;/CryptographicKeys&gt;
            &lt;InputClaims&gt;
              &lt;InputClaim ClaimTypeReferenceId="email" /&gt;
            &lt;/InputClaims&gt;
            &lt;OutputClaims&gt;
              &lt;OutputClaim ClaimTypeReferenceId="objectId" /&gt;
              &lt;OutputClaim ClaimTypeReferenceId="email" PartnerClaimType="Verified.Email" Required="true" /&gt;
              &lt;OutputClaim ClaimTypeReferenceId="newPassword" Required="true" /&gt;
              &lt;OutputClaim ClaimTypeReferenceId="reenterPassword" Required="true" /&gt;
              &lt;OutputClaim ClaimTypeReferenceId="executed-SelfAsserted-Input" DefaultValue="true" /&gt;
              &lt;OutputClaim ClaimTypeReferenceId="authenticationSource" /&gt;
              &lt;OutputClaim ClaimTypeReferenceId="newUser" /&gt;
              &lt;!-- Optional claims, to be collected from the user --&gt;
              &lt;!--&lt;OutputClaim ClaimTypeReferenceId="displayName" /&gt;--&gt;
              &lt;OutputClaim ClaimTypeReferenceId="givenName" Required="true" /&gt;
              &lt;OutputClaim ClaimTypeReferenceId="surName" Required="true" /&gt;
  
              &lt;OutputClaim ClaimTypeReferenceId="country" Required="true"/&gt;
              &lt;OutputClaim ClaimTypeReferenceId="city" Required="true" /&gt;
              &lt;OutputClaim ClaimTypeReferenceId="extension_Company" /&gt;
              &lt;OutputClaim ClaimTypeReferenceId="extension_Phone" /&gt;
              &lt;OutputClaim ClaimTypeReferenceId="extension_MarketingConsent" /&gt;
            &lt;/OutputClaims&gt;
            &lt;ValidationTechnicalProfiles&gt;
              &lt;ValidationTechnicalProfile ReferenceId="AAD-UserWriteUsingLogonEmail" /&gt;
            &lt;/ValidationTechnicalProfiles&gt;
            &lt;UseTechnicalProfileForSessionManagement ReferenceId="SM-AAD" /&gt;
          &lt;/TechnicalProfile&gt;
          &lt;!-- This technical profile uses a validation technical profile to authenticate the user. --&gt;
          &lt;TechnicalProfile Id="SelfAsserted-LocalAccountSignin-Email"&gt;
            &lt;DisplayName&gt;Local Account Signin&lt;/DisplayName&gt;
            &lt;Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.SelfAssertedAttributeProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" /&gt;
            &lt;Metadata&gt;
              &lt;Item Key="SignUpTarget"&gt;SignUpWithLogonEmailExchange&lt;/Item&gt;
              &lt;Item Key="setting.operatingMode"&gt;Email&lt;/Item&gt;
              &lt;Item Key="ContentDefinitionReferenceId"&gt;api.selfasserted&lt;/Item&gt;
            &lt;/Metadata&gt;
            &lt;IncludeInSso&gt;false&lt;/IncludeInSso&gt;
            &lt;InputClaims&gt;
              &lt;InputClaim ClaimTypeReferenceId="email" /&gt;
            &lt;/InputClaims&gt;
            &lt;OutputClaims&gt;
              &lt;OutputClaim ClaimTypeReferenceId="email" Required="true" /&gt;
              &lt;OutputClaim ClaimTypeReferenceId="password" Required="true" /&gt;
              &lt;OutputClaim ClaimTypeReferenceId="objectId" /&gt;
              &lt;OutputClaim ClaimTypeReferenceId="authenticationSource" /&gt;
            &lt;/OutputClaims&gt;
            &lt;ValidationTechnicalProfiles&gt;
              &lt;ValidationTechnicalProfile ReferenceId="login-NonInteractive" /&gt;
            &lt;/ValidationTechnicalProfiles&gt;
            &lt;UseTechnicalProfileForSessionManagement ReferenceId="SM-AAD" /&gt;
          &lt;/TechnicalProfile&gt;
          &lt;!-- This technical profile forces the user to verify the email address that they provide on the UI. Only after email is verified, the user account is
          read from the directory. --&gt;
          &lt;TechnicalProfile Id="LocalAccountDiscoveryUsingEmailAddress"&gt;
            &lt;DisplayName&gt;Reset password using email address&lt;/DisplayName&gt;
            &lt;Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.SelfAssertedAttributeProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" /&gt;
            &lt;Metadata&gt;
              &lt;Item Key="IpAddressClaimReferenceId"&gt;IpAddress&lt;/Item&gt;
              &lt;Item Key="ContentDefinitionReferenceId"&gt;api.localaccountpasswordreset&lt;/Item&gt;
              &lt;Item Key="UserMessageIfClaimsTransformationBooleanValueIsNotEqual"&gt;Your account has been locked. Contact your support person to unlock it, then try again.&lt;/Item&gt;
            &lt;/Metadata&gt;
            &lt;CryptographicKeys&gt;
              &lt;Key Id="issuer_secret" StorageReferenceId="B2C_1A_TokenSigningKeyContainer" /&gt;
            &lt;/CryptographicKeys&gt;
            &lt;IncludeInSso&gt;false&lt;/IncludeInSso&gt;
            &lt;OutputClaims&gt;
              &lt;OutputClaim ClaimTypeReferenceId="email" PartnerClaimType="Verified.Email" Required="true" /&gt;
              &lt;OutputClaim ClaimTypeReferenceId="objectId" /&gt;
              &lt;OutputClaim ClaimTypeReferenceId="userPrincipalName" /&gt;
              &lt;OutputClaim ClaimTypeReferenceId="authenticationSource" /&gt;
            &lt;/OutputClaims&gt;
            &lt;ValidationTechnicalProfiles&gt;
              &lt;ValidationTechnicalProfile ReferenceId="AAD-UserReadUsingEmailAddress" /&gt;
            &lt;/ValidationTechnicalProfiles&gt;
          &lt;/TechnicalProfile&gt;
          &lt;TechnicalProfile Id="LocalAccountWritePasswordUsingObjectId"&gt;
            &lt;DisplayName&gt;Change password (username)&lt;/DisplayName&gt;
            &lt;Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.SelfAssertedAttributeProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" /&gt;
            &lt;Metadata&gt;
              &lt;Item Key="ContentDefinitionReferenceId"&gt;api.localaccountpasswordreset&lt;/Item&gt;
            &lt;/Metadata&gt;
            &lt;CryptographicKeys&gt;
              &lt;Key Id="issuer_secret" StorageReferenceId="B2C_1A_TokenSigningKeyContainer" /&gt;
            &lt;/CryptographicKeys&gt;
            &lt;InputClaims&gt;
              &lt;InputClaim ClaimTypeReferenceId="objectId" /&gt;
            &lt;/InputClaims&gt;
            &lt;OutputClaims&gt;
              &lt;OutputClaim ClaimTypeReferenceId="newPassword" Required="true" /&gt;
              &lt;OutputClaim ClaimTypeReferenceId="reenterPassword" Required="true" /&gt;
            &lt;/OutputClaims&gt;
            &lt;ValidationTechnicalProfiles&gt;
              &lt;ValidationTechnicalProfile ReferenceId="AAD-UserWritePasswordUsingObjectId" /&gt;
            &lt;/ValidationTechnicalProfiles&gt;
          &lt;/TechnicalProfile&gt;
        &lt;/TechnicalProfiles&gt;
      &lt;/ClaimsProvider&gt;
      &lt;ClaimsProvider&gt;
        &lt;DisplayName&gt;Session Management&lt;/DisplayName&gt;
        &lt;TechnicalProfiles&gt;
          &lt;TechnicalProfile Id="SM-Noop"&gt;
            &lt;DisplayName&gt;Noop Session Management Provider&lt;/DisplayName&gt;
            &lt;Protocol Name="Proprietary" Handler="Web.TPEngine.SSO.NoopSSOSessionProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" /&gt;
          &lt;/TechnicalProfile&gt;
          &lt;TechnicalProfile Id="SM-AAD"&gt;
            &lt;DisplayName&gt;Session Mananagement Provider&lt;/DisplayName&gt;
            &lt;Protocol Name="Proprietary" Handler="Web.TPEngine.SSO.DefaultSSOSessionProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" /&gt;
            &lt;PersistedClaims&gt;
              &lt;PersistedClaim ClaimTypeReferenceId="objectId" /&gt;
              &lt;PersistedClaim ClaimTypeReferenceId="email" /&gt;
              &lt;PersistedClaim ClaimTypeReferenceId="authenticationSource" /&gt;
              &lt;PersistedClaim ClaimTypeReferenceId="identityProvider" /&gt;
              &lt;PersistedClaim ClaimTypeReferenceId="newUser" /&gt;
              &lt;PersistedClaim ClaimTypeReferenceId="executed-SelfAsserted-Input" /&gt;
            &lt;/PersistedClaims&gt;
            &lt;OutputClaims&gt;
              &lt;OutputClaim ClaimTypeReferenceId="objectIdFromSession" DefaultValue="true" /&gt;
            &lt;/OutputClaims&gt;
          &lt;/TechnicalProfile&gt;
        &lt;/TechnicalProfiles&gt;
      &lt;/ClaimsProvider&gt;
      &lt;ClaimsProvider&gt;
        &lt;DisplayName&gt;Trustframework Policy Engine TechnicalProfiles&lt;/DisplayName&gt;
        &lt;TechnicalProfiles&gt;
          &lt;TechnicalProfile Id="TpEngine_c3bd4fe2-1775-4013-b91d-35f16d377d13"&gt;
            &lt;DisplayName&gt;Trustframework Policy Engine Default Technical Profile&lt;/DisplayName&gt;
            &lt;Protocol Name="None" /&gt;
            &lt;Metadata&gt;
              &lt;Item Key="url"&gt;{service:te}&lt;/Item&gt;
            &lt;/Metadata&gt;
          &lt;/TechnicalProfile&gt;
        &lt;/TechnicalProfiles&gt;
      &lt;/ClaimsProvider&gt;
      &lt;ClaimsProvider&gt;
        &lt;DisplayName&gt;Token Issuer&lt;/DisplayName&gt;
        &lt;TechnicalProfiles&gt;
          &lt;TechnicalProfile Id="JwtIssuer"&gt;
            &lt;DisplayName&gt;JWT Issuer&lt;/DisplayName&gt;
            &lt;Protocol Name="None" /&gt;
            &lt;OutputTokenFormat&gt;JWT&lt;/OutputTokenFormat&gt;
            &lt;Metadata&gt;
              &lt;Item Key="client_id"&gt;{service:te}&lt;/Item&gt;
              &lt;Item Key="issuer_refresh_token_user_identity_claim_type"&gt;objectId&lt;/Item&gt;
              &lt;Item Key="SendTokenResponseBodyWithJsonNumbers"&gt;true&lt;/Item&gt;
            &lt;/Metadata&gt;
            &lt;CryptographicKeys&gt;
              &lt;Key Id="issuer_secret" StorageReferenceId="B2C_1A_TokenSigningKeyContainer" /&gt;
              &lt;Key Id="issuer_refresh_token_key" StorageReferenceId="B2C_1A_TokenEncryptionKeyContainer" /&gt;
            &lt;/CryptographicKeys&gt;
            &lt;InputClaims /&gt;
            &lt;OutputClaims /&gt;
          &lt;/TechnicalProfile&gt;
        &lt;/TechnicalProfiles&gt;
      &lt;/ClaimsProvider&gt;
    &lt;/ClaimsProviders&gt;
  &lt;/TrustFrameworkPolicy&gt;
  </code></pre>