Skip to main content

Configure Claims for Microsoft Entra Applications in EmpowerID

As an application owner or administrator, you can configure custom claims for Microsoft Entra applications, controlling what user attributes are included in authentication tokens.

caution

Claims configured through this workflow overwrite any claims set in the Microsoft Entra admin center.

Overview​

EmpowerID's Manage Azure App Wizard workflow allows you to configure:

  • Source claims from user or application attributes
  • Static (hardcoded) claims
  • Optional claims such as email or auth_time
  • Group membership claims for access control

Once configured, these claims are added to ID or Access tokens issued to the selected Microsoft Entra application(s).

What You'll Need​

RequirementDescription
Application AccessYou must have permission to access the Azure application in EmpowerID.
Workflow AccessYou must be authorized to run the Manage Azure App Wizard workflow.

Before You Begin​

Before configuring claims, make sure to review the following:

  • Know which token types (Access or ID) your application requires.
  • Determine whether your application expects roles, groups, or both.
  • Identify the attributes you want to include as source claims (e.g., user.mail, user.displayName).
  • Understand that any claims currently configured in Microsoft Entra will be overwritten.

Steps to Add or Remove Claims for an Application​

warning

Clicking Back before clicking Next on any step discards your changes for that step.

  1. Navigate to the portal for the Resource Admin app in your environment.
  2. Log in using your credentials.
note

If you don't know the direct URL to Resource Admin, contact your EmpowerID administrator.

  1. From the dropdown menu, choose Applications.

  2. Search for the target application.

  3. Click the Details button on the record returned for the application.
    Application Details Button

    This opens the Overview screen for the application.
    Application Overview

  4. In the left menu, expand Token Configurations and click Claims Mapping Policy.
    Application Claims Tab

  5. On the claims view, click Add/Remove Claims to launch the configuration workflow.
    Add and Remove Claims Button

  6. Select the tab for the type of claim you need to add:

    • Source Claims – Define dynamic claims sourced from user, application, resource, audience, or company attributes.
      Source Claims Form
    • Static Claims – Define static (hardcoded) claims with fixed values.
      Static Claims Form
note

If no claims currently exist, an empty row appears automatically. Otherwise, click + Add New Item to define a new claim.

  1. Fill in the fields appropriate to the claim type:
FieldApplies ToDescription
Source AttributeSource ClaimsAttribute to source the value (e.g., user.mail)
Claim ValueStatic ClaimsStatic value to include in the token
Claim DescriptionBoth(Optional) A friendly label for the claim
JWT Claim TypeBothName of the claim in the token (e.g., email)
  1. Repeat for any additional claims by clicking + Add New Item.
  2. If needed, switch to the other tab and repeat steps 1–3.
note

To remove an existing claim, click the Trash Can icon beside it.
Delete Source Claim

tip

To remove claims from a reusable policy (not specific to an app), see Update Claims Mapping Policy.

  1. When finished, click Next to proceed, or click Back to return to the previous step.

  2. (Optional) Configure optional claims for Access Tokens and/or ID Tokens. If not needed, click Next to skip.
    Optional Claims Form

  3. Select the Access Token or ID Token tab.

  4. Use the checkboxes to enable or disable specific optional claims. Common optional claims include: auth_time, email, in_corp, verified_primary_email.

  5. When finished, click Next to continue, or click Back to return to the previous step.

  6. (Optional) Configure group claims to control how group membership is included in the token. If not needed, click Next to skip.
    Group Claims Form

  7. Select the desired Group Type:

Group TypeDescription
Security groupsIncludes security groups and Azure AD roles
All groupsIncludes security groups, directory roles, and distribution lists
Directory rolesEmits roles only if assigned
Groups assigned to the appEmits only groups explicitly assigned to the application
  1. Choose the Group Claim Format for each token type (Access and/or ID):
Group Claim FormatDescription
Azure AD Group ObjectIdEmits each group as its Azure AD object GUID
DNSDomainName\sAMAccountNameUses the domain's FQDN and the group's SAM account name
NetbiosDomain\sAMAccountNameUses the legacy NetBIOS domain and SAM account name
On-Premises Group Security IdentifierEmits the group's SID from on-premises Active Directory
sAMAccountNameEmits just the group's SAM account name

  1. (Optional) Enable Emit groups as role claims if your app expects group claims to be interpreted as roles.

  2. When finished, click Next to continue, or click Back to return to the previous step.

  3. Review the Microsoft Entra Application Operation Execution Summary to confirm each step succeeded.
    Update App Claims Operation Execution Summary

  4. Click Submit to continue.

  5. Select what you want to do next:

  • Manage the same Microsoft Entra application(s)
  • Manage different Microsoft Entra application(s)
  • Finish and exit the wizard
  1. Click Submit.

Finish Workflow Actions

What Happens Next​

After completing the wizard:

  • EmpowerID creates or updates the claims mapping policy.
  • The policy is assigned to the selected Microsoft Entra application(s).
  • Claims are included in issued tokens according to your configuration.
  • Changes take effect the next time a token is issued.