How to add a custom claim and retrieve the same as part of access_token, when the scope is not Graph API in Azure AD?

Question

I have created a Azure AD web application. Now I am getting my access_token using following API,

POST https://login.microsoftonline.com/{Directory (tenant) ID }/oau

Answer 1

Please refer to the following steps (You can do the Microsoft Graph operation in Microsoft Graph Explorer for saving time.):

Create an extensionProperty (you could use a new created Azure AD application here):

Post https://graph.microsoft.com/v1.0/applications/{object id of the Azure AD application}/extensionProperties

{"name":"policy","dataType":"string","targetObjects":["User"]}

It will generate an extension property named extension_{client id of the Azure AD application}_policy.

Secondly, you can update the extension property for your account:

Patch https://graph.microsoft.com/v1.0/me

{"extension_6d8190fbf1fe4bc38a5a145520221989_policy":"readwrite"}

Then create a claimsMappingPolicy:

Post https://graph.microsoft.com/v1.0/policies/claimsMappingPolicies

{"definition":["{\"ClaimsMappingPolicy\":{\"Version\":1,\"IncludeBasicClaimSet\":\"true\", \"ClaimsSchema\": [{\"Source\":\"user\",\"ExtensionID\":\"extension_6d8190fbf1fe4bc38a5a145520221989_policy\",\"JwtClaimType\":\"policy\"}]}}"],"displayName":"ExtraClaimsAllen1Example","isOrganizationDefault":true}

Assign the claimsMappingPolicy to a servicePrincipal. Please Note that the servicePrincipal here is the enterprise application which represents your third party application. In your case it is 0a7c94a0-0c4e-4f95-ba06-XXXX.

Post https://graph.microsoft.com/v1.0/servicePrincipals/{obeject id of the servicePrincipal which represents your third party application}/claimsMappingPolicies/$ref

{"@odata.id":"https://graph.microsoft.com/v1.0/policies/claimsMappingPolicies/{policy id from the previous step}"}

You could find the servicePrincipal from Azure Portal -> Azure Active Directory -> App registrations -> find your third party Azure AD app -> Overview -> click on the name of its associated service principal.

Now go back to the manifest file of the third party Azure AD app. Set acceptMappedClaims to true and accessTokenAcceptedVersion to 2.

Then when we request an access token for the third party application with ROPC grant flow, we can get the custom claim.