Merge pull request #249730 from Gargi-Sinha/patch-194

Update claims-mapping.md

Author: prmerger-automator[bot]

articles/active-directory/external-identities/claims-mapping.md

@@ -6,7 +6,7 @@ services: active-directory
 ms.service: active-directory
 ms.subservice: B2B
 ms.topic: conceptual
-ms.date: 11/24/2022
+ms.date: 08/30/2023
 
 ms.author: cmulligan
 author: csmulligan
@@ -32,7 +32,16 @@ There are two possible reasons why you might need to edit the claims that are is
 
 For information about how to add and edit claims, see [Customizing claims issued in the SAML token for enterprise applications in Azure Active Directory](../develop/saml-claims-customization.md).
 
-For B2B collaboration users, mapping NameID and UPN cross-tenant are prevented for security reasons.
+## UPN claims behavior for B2B users
+
+If you need to issue the UPN value as an application token claim, the actual claim mapping may behave differently for B2B users. If the B2B user authenticates with an external Azure AD identity and you issue user.userprincipalname as the source attribute, Azure AD instead issues the mail attribute.  
+
+For example, let’s say you invite an external user whose email is `[email protected]` and whose identity exists in an external Azure AD tenant. James’ UPN in the inviting tenant is created from the invited email and the inviting tenant's original default domain. So, let’s say James’ UPN becomes `James_contoso.com#EXT#@fabrikam.onmicrosoft.com`. For the SAML application that issues user.userprincipalname as the NameID, the value passed for James is `[email protected]`.  
+
+All [other external identity types](redemption-experience.md#invitation-redemption-flow) such as SAML/WS-Fed, Google, Email OTP issues the UPN value rather than the email value when you issue user.userprincipalname as a claim. If you want the actual UPN to be issued in the token claim for all B2B users, you can set user.localuserprincipalname as the source attribute instead. 
+
+>[!NOTE]
+>The behavior mentioned in this section is same for both cloud-only B2B users and synced users who were [invited/converted to B2B collaboration](invite-internal-users.md). 
 
 ## Next steps