How to set up custom mapped claims to AzureAd App Registrations

Question

I'm trying to get some specific property (employeeid) in tokens generated by Azure AD applications (not enterprises app) to request an exposed API with Azure AD. But so far I'm not able to get the property unless it is defined in the optional claims provided.

I read for Enterprises Application is possible to map the claim and get more properties the the defined ones in token claims, but How can I do this in App Registered by myself?

Answer 1

To get specific property in Azure AD tokens, I created the policy like below:

New-AzureADPolicy -Definition @('
{
    "ClaimsMappingPolicy":
    {
        "Version":1,"IncludeBasicClaimSet":"true", 
        "ClaimsSchema": [{"Source":"user","ID":"extensionattribute1","SamlClaimType":"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/employeeid","JwtClaimType":"employeeid"}]
    }
}') -DisplayName "employeeid" -Type "ClaimsMappingPolicy"

Add-AzureADServicePrincipalPolicy  -RefObjectId 'PolicyID' -Id 'ServicePrincipalObjID'

After applying the policy, I assigned it to the user like below:

PATCH https://graph.microsoft.com/v1.0/me

{
"onPremisesExtensionAttributes": {
"extensionAttribute1": "12345"
}
}

I generated access token using below parameters:

https://login.microsoftonline.com/TenantID/oauth2/v2.0/token

client_id:ClientID
grant_type:authorization_code
scope:https://graph.microsoft.com/.default openid
code:code
redirect_uri:https://jwt.ms
client_secret:ClientSecret

When I decoded the token, employeeid is displayed like below:

Note that: To display the property in the Azure AD token, Service Principal ID is required. You cannot assign it to the Azure AD App ID (App Registration).