Configuring and Using Custom Claims in Microsoft Entra ID

Microsoft Entra ID (formerly Azure AD) now makes it easier to configure custom claims for applications to trust it for authentication and authorization.

Custom claims, or optional claims, are typically needed to provide additional information in Access Tokens to assist the receiving API in authorizing access to resource data. Custom claims in ID Tokens can be used by an application to provide custom experiences based on these claims.

Role or Group claims are typically used to provide conditional access to resource data, but third-party applications may require additional data that is not included in these claims. For example, an application may require department or division information to assist in determining what data to expose. Using custom claims, this information can be readily obtained from existing directory information. 

In this technical webinar, Principal Consultant Randy Robb covers Microsoft Entra's new application configuration blade for utilizing custom attributes, and how this can be utilized to provide custom claims in SAML, ID, and access tokens. He also demos examples of custom claims in returned tokens and how to utilize them.

[nryttv]

After lot of googling, found this video the most helpful! Thanks

[saiwares]

Sheesh.. It was there all the while I spent 2 days trying to make custom claims work by adding them as Optional Claims from App Registration instead. Those claim names would appear in Manifest file but never appear in ID or Access tokens. Entra ID is really a bad implementation. Receiving Manager, Sponsor and custom non-predefined attributes in claims are still a headache.

[Parawata]

This video has been really helpful setting up Clients with custom claims through Entra. What I want to do next is automate this through bash scripts using the Azure Cli. I've managed to configure the majority of the client registration, i.e. app roles, consent, manifest changes etc. However I've hit a bit of a wall trying to find a way to add custom claims through the Single Sign On available in the Enterprise Application section.

Is it possible to do this from the command line, that is through Azure Cli from bash, not powershell? Tokens generated are for api to api using the client_cred flow so optional claims to support this don't seem like an option.

Any input much appreciated!