property 'samlToken' does not exist on type 'Microsoft.DirectoryServices.OptionalClaims'

[dammitjanet]

When creating or updating an Azure Ad Application, and adding optionalClaims, if you supply a samlToken List of OptionalClaim you get the following error

Set-AzureADApplication : Error occurred while executing SetApplication 
Code: Request_BadRequest
Message: The property 'samlToken' does not exist on type 'Microsoft.DirectoryServices.OptionalClaims'. Make sure to only use property names that are defined by the type.
RequestId: <obfuscated>
DateTimeStamp: Thu, 15 Jul 2021 08:47:01 GMT
HttpStatusCode: BadRequest
HttpStatusDescription: Bad Request
HttpResponseStatus: Completed
At C:\<obfuscated>\App Manifests\test-creation.ps1:73 char:1
+ Set-AzureADApplication -ObjectId $appObjectId -RequiredResourceAccess ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [Set-AzureADApplication], ApiException
    + FullyQualifiedErrorId : Microsoft.Open.AzureAD16.Client.ApiException,Microsoft.Open.AzureAD16.PowerShell.SetApplication

It would appear to be an underlying issue as at least one other implementation also have this issue.

Certainly the type is different, but that may be an inheritance thing, or the wrong class is being used entirely as the model is of type Microsoft.Open.AzureAD.Model.OptionalClaims and not Microsoft.DirectoryServices.OptionalClaims'

$groups_claim = [Microsoft.Open.AzureAD.Model.OptionalClaim]::new("groups", $null, $false, @("sam_account_name","emit_as_roles"))
$email_claim = [Microsoft.Open.AzureAD.Model.OptionalClaim]::new("email", $null, $false, @())
$username_claim = [Microsoft.Open.AzureAD.Model.OptionalClaim]::new("preferred_username", $null, $false,  @())

$idtoken_claims = [System.Collections.Generic.List[Microsoft.Open.AzureAD.Model.OptionalClaim]]::new(2)
$idtoken_claims.Add($email_claim)
$idtoken_claims.Add($groups_claim)

$accessToken_claims = [System.Collections.Generic.List[Microsoft.Open.AzureAD.Model.OptionalClaim]]::new(2)
$accessToken_claims.Add($username_claim)
$accessToken_claims.Add($groups_claim)

$saml2Token_claims = [System.Collections.Generic.List[Microsoft.Open.AzureAD.Model.OptionalClaim]]::new(1)
$saml2Token_claims.Add($groups_claim)

$optional_claims = [Microsoft.Open.AzureAD.Model.OptionalClaims]::new($idtoken_claims, $accessToken_claims, $saml2Token_claims)

 #Set permissions in existing Azure AD App
$appObjectId=$aadApplication.ObjectId
Set-AzureADApplication -ObjectId $appObjectId -OptionalClaims

[drem-darios]

This is still an issue. Any plans on releasing a fix in the near future?!

[drem-darios]

@dammitjanet Did you ever find a workaround for this? This is clearly a bug since the documentation shows the parameter is saml2Token

[dammitjanet]

@drem-darios sorry no, I've had to use the Azure Portal to achieve what I needed