Search code examples
oauthazure-active-directoryclaimsazure-app-registration

Optional/Custom claim for OAuth app in Azure AD

Can I add the user.officelocation claim for OAuth registered app in Azure AD? If I add it in its service principal in Enterprise Apps ? Will it work ? Do I get office location of users (synced users) in Access token? Or i need to configure something else (office location field is blank in user properties)in user' profile? My app has user.read.all scope granted.

Solution

  • Yes, you can use Azure AD access token to get office location of users.

    In the Azure AD application and updated the manifest:

    enter image description here

    In the Enterprise application added claim like below:

    enter image description here

    Granted API permissions:

    enter image description here

    I generated the access token and the office location claim displayed successfully:

    https://login.microsoftonline.com/TenantID/oauth2/v2.0/authorize?client_id=ClientID&response_type=token&redirect_uri=https://jwt.ms&scope=api://xxx/claims.read&state=12345&nonce=12345

    enter image description here

    Note that: If the user doesn't have the office location updated then the claim will not be returned in the access token.

    enter image description here

    Make sure that the office location attribute is sync'd or update it in user properties:

    Go to Azure Portal -> Users -> Edit properties

    enter image description here