Skip to main content

Create a Claims Mapping Policy in EmpowerID

As an administrator, you can create reusable claims mapping policies that control what user information—such as roles, departments, or group membership—is sent to Azure applications after sign-in. Applications use this data to determine what authenticated users are allowed to do.

caution

Claims added to a policy are reused across applications. To configure claims for a single app, use the Manage Azure App Wizard instead.

What You'll Need​

RequirementDescription
Tenant AccessThe Azure tenant must already be registered in EmpowerID.

Steps to Create a Claims Mapping Policy​

  1. Navigate to the portal for the Resource Admin app in your environment.
  2. Log in using your credentials.
note

If you don't know the direct URL to Resource Admin, contact your EmpowerID administrator.

  1. From the dropdown menu, select Applications, then click the Workflows tab. Applications Workflow Tab
  2. Search for CreateAzureClaims, then click the Create Microsoft Entra Claims Mapping Policy workflow tile. Create Claims Mapping Policy

The workflow opens to the Tenant & Policy Details screen.

Claims Mapping Policy Details

  1. Complete the following fields:
    • Select a Tenant – Choose the Azure tenant the policy applies to.
    • Policy Name – Enter a unique internal identifier.
    • Policy Friendly Name – Enter a display name for the UI.
    • Include Basic Claim Set – Check to automatically include standard claims like user ID, email, and display name.
    • Select a Location – Choose an RBAC location for policy delegation.
tip

If a default location is pre-filled and needs to be changed, click the (X) next to the field and then click Select a Location to search.

  1. Click Next to proceed.
Unsaved Changes

If you click Back before clicking Next, your changes on this step will be lost.

The wizard continues to the Add Microsoft Entra Claims screen with the Source Claims tab open.

Source Claims Tab

Use this step to add dynamic claims based on user, application, or resource attributes.

  1. Click + Add New Item to add a new row.
  2. Complete the following fields:
FieldDescription
Source AttributeAzure attribute to use as the value (e.g., user.mail)
SAML Claim TypeClaim type expected by SAML applications
SAML Name FormatName format such as emailAddress or unspecified
JWT Claim TypeClaim name for JWT tokens (e.g., email)
  1. Repeat to add more claims as needed.
  2. When finished, either:
    • Click the Static Claims tab to add static values, or
    • Click Next to skip static claims and continue.
Unsaved Changes

If you click Back before clicking Next, your changes on this step will be lost.

  1. To add static (hardcoded) claims, click the Static Claims tab.
    Static Claims Tab
  2. Click + Add New Item.
  3. Complete the following fields:
FieldDescription
Claim ValueThe static value to include (e.g., true, Engineering)
Claim Description(Optional) Friendly label to help identify the claim
SAML Claim TypeSAML claim type used by apps expecting SAML tokens
SAML Name FormatFormat such as emailAddress, unspecified, etc.
JWT Claim TypeJWT claim name for token output
  1. Repeat to add more static claims if needed.
  2. Click Next to proceed.
Unsaved Changes

If you click Back before clicking Next, your changes on this step will be lost.

  1. Review your selections and claims for accuracy on the Summary screen.
  2. If changes are needed, click Back.
  3. When ready, click Submit to create the policy.
  4. From the Applications dropdown, select Claims Mapping Policies.
  5. Search for the policy name and click Details to confirm the configuration.

What Happens Next​

  • Your new policy can now be assigned to one or more Microsoft Entra applications.
  • Claims in the policy will be emitted to tokens for those apps once assigned.