Skip to main content

Create a Claims Mapping Policy in EmpowerID

Claims mapping policies control what user information is sent to an Azure application after sign-in. Applications can then use this data—such as roles, departments, or group membership—to determine what the user is allowed to do.

This guide shows you how to create a reusable claims mapping policy in EmpowerID using the Create Microsoft Entra Claims Mapping Policy workflow in the Resource Admin app.

caution

Claims added to a policy are reused across applications. To configure claims for a single app, use the Manage Azure App Wizard instead.

What You'll Need​

RequirementDescription
AccessYou must have permission to access applications in Resource Admin and manage policies for your Azure tenant.
Tenant AccessThe Azure tenant must already be registered in EmpowerID.

Steps to Create a Claims Mapping Policy​

1. Launch the Create Claims Mapping Policy Workflow​

  1. Navigate to the portal for the Resource Admin app in your environment.
  2. Log in using your credentials.
note

If you don’t know the direct URL to Resource Admin, contact your EmpowerID administrator.

  1. From the dropdown menu, select Applications, then click the Workflows tab. Applications Workflow Tab
  2. Search for CreateAzureClaims, then click the Create Microsoft Entra Claims Mapping Policy workflow tile. Create Claims Mapping Policy

2. Enter Tenant and Policy Details​

The workflow opens to the Tenant & Policy Details screen.

Claims Mapping Policy Details

  1. Complete the following fields:
    • Select a Tenant – Choose the Azure tenant the policy applies to.
    • Policy Name – Enter a unique internal identifier.
    • Policy Friendly Name – Enter a display name for the UI.
    • Include Basic Claim Set – Check to automatically include standard claims like user ID, email, and display name.
    • Select a Location – Choose an RBAC location for policy delegation.
tip

If a default location is pre-filled and needs to be changed, click the (X) next to the field and then click Select a Location to search.

  1. Click Next to proceed.
Unsaved Changes

If you click Back before clicking Next, your changes on this step will be lost.

3. (Optional) Add Source Claims​

The wizard continues to the Add Microsoft Entra Claims screen with the Source Claims tab open.

Source Claims Tab

Use this step to add dynamic claims based on user, application, or resource attributes.

  1. Click + Add New Item to add a new row.
  2. Complete the following fields:
FieldDescription
Source AttributeAzure attribute to use as the value (e.g., user.mail)
SAML Claim TypeClaim type expected by SAML applications
SAML Name FormatName format such as emailAddress or unspecified
JWT Claim TypeClaim name for JWT tokens (e.g., email)
  1. Repeat to add more claims as needed.
  2. When finished, either:
    • Click the Static Claims tab to add static values, or
    • Click Next to skip static claims and continue.
Unsaved Changes

If you click Back before clicking Next, your changes on this step will be lost.

4. (Optional) Add Static Claims​

Use this screen to define static (hardcoded) claims that always emit the same value.

Static Claims Tab

  1. Click + Add New Item.
  2. Complete the following fields:
FieldDescription
Claim ValueThe static value to include (e.g., true, Engineering)
Claim Description(Optional) Friendly label to help identify the claim
SAML Claim TypeSAML claim type used by apps expecting SAML tokens
SAML Name FormatFormat such as emailAddress, unspecified, etc.
JWT Claim TypeJWT claim name for token output
  1. Repeat to add more static claims if needed.
  2. Click Next to proceed.
Unsaved Changes

If you click Back before clicking Next, your changes on this step will be lost.

5. Review and Submit​

The summary screen appears.

  1. Review your selections and claims for accuracy.
  2. If changes are needed, click Back.
  3. When ready, click Submit to create the policy.

You will see a confirmation message upon success.

6. Verify the Policy​

  1. From the Applications dropdown, select Claims Mapping Policies.
  2. Search for the policy name.
  3. Click Details to confirm the configuration.

What Happens Next​

  • Your new policy can now be assigned to one or more Microsoft Entra applications.
  • Claims in the policy will be emitted to tokens for those apps once assigned.