You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/active-directory-b2c/active-directory-technical-profile.md
+23-17Lines changed: 23 additions & 17 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -60,13 +60,13 @@ To read, update, or delete an existing user account, the input claim is a key th
60
60
61
61
To create a new user account, the input claim is a key that uniquely identifies a local or federated account. For example, local account: **signInNames.emailAddress**, or **signInNames.userName**. For a federated account: the **alternativeSecurityId**.
62
62
63
-
The InputClaimsTransformations element may contain a collection of input claims transformation elements that are used to modify the input claim or generate new one.
63
+
The [InputClaimsTransformations](technicalprofiles.md#inputclaimstransformations) element may contain a collection of input claims transformation elements that are used to modify the input claim or generate new one.
64
64
65
65
## OutputClaims
66
66
67
67
The **OutputClaims** element contains a list of claims returned by the Azure AD technical profile. You may need to map the name of the claim defined in your policy to the name defined in Azure Active Directory. You can also include claims that aren't returned by the Azure Active Directory, as long as you set the `DefaultValue` attribute.
68
68
69
-
The **OutputClaimsTransformations** element may contain a collection of **OutputClaimsTransformation** elements that are used to modify the output claims or generate new ones.
69
+
The [OutputClaimsTransformations](technicalprofiles.md#outputclaimstransformations) element may contain a collection of **OutputClaimsTransformation** elements that are used to modify the output claims or generate new ones.
70
70
71
71
For example, the **AAD-UserWriteUsingLogonEmail** technical profile creates a local account and returns the following claims:
72
72
@@ -88,7 +88,7 @@ For example, the **AAD-UserWriteUsingLogonEmail** technical profile creates a lo
88
88
89
89
## PersistedClaims
90
90
91
-
The **PersistedClaims** element contains all of the values that should be persisted by Azure AD with possible mapping information between a claim type already defined in the ClaimsSchema section in the policy and the Azure AD attribute name.
91
+
The **PersistedClaims** element contains all of the values that should be persisted by Azure AD with possible mapping information between a claim type already defined in the [ClaimsSchema](claimsschema.md) section in the policy and the Azure AD attribute name.
92
92
93
93
The **AAD-UserWriteUsingLogonEmail** technical profile, which creates new local account, persists following claims:
94
94
@@ -119,9 +119,7 @@ The name of the claim is the name of the Azure AD attribute unless the **Partner
119
119
120
120
### Read
121
121
122
-
The **Read** operation reads data about a single user account. To read user data, you need to provide a key as an input claim, such as **objectId**, **userPrincipalName**, **signInNames** (any type, user name and email-based account) or **alternativeSecurityId**.
123
-
124
-
The following technical profile reads data about a user account using the user's objectId:
122
+
The **Read** operation reads data about a single user account. The following technical profile reads data about a user account using the user's objectId:
125
123
126
124
```XML
127
125
<TechnicalProfileId="AAD-UserReadUsingObjectId">
@@ -151,9 +149,7 @@ The following technical profile reads data about a user account using the user's
151
149
152
150
### Write
153
151
154
-
The **Write** operation creates or updates a single user account. To write a user account, you need to provide a key as an input claim, such as **objectId**, **userPrincipalName**, **signInNames.emailAddress**, or **alternativeSecurityId**.
155
-
156
-
The following technical profile creates new social account:
152
+
The **Write** operation creates or updates a single user account. The following technical profile creates new social account:
@@ -193,9 +189,7 @@ The following technical profile creates new social account:
193
189
194
190
### DeleteClaims
195
191
196
-
The **DeleteClaims** operation clears the information from a provided list of claims. To delete information from claims, you need to provide a key as an input claim, such as **objectId**, **userPrincipalName**, **signInNames.emailAddress** or **alternativeSecurityId**.
197
-
198
-
The following technical profile deletes claims:
192
+
The **DeleteClaims** operation clears the information from a provided list of claims. The following technical profile deletes claims:
@@ -216,9 +210,7 @@ The following technical profile deletes claims:
216
210
217
211
### DeleteClaimsPrincipal
218
212
219
-
The **DeleteClaimsPrincipal** operation deletes a single user account from the directory. To delete a user account, you need to provide a key as an input claim, such as **objectId**, **userPrincipalName**, **signInNames.emailAddress** or **alternativeSecurityId**.
220
-
221
-
The following technical profile deletes a user account from the directory using the user principal name:
213
+
The **DeleteClaimsPrincipal** operation deletes a single user account from the directory. The following technical profile deletes a user account from the directory using the user principal name:
@@ -253,13 +245,27 @@ The following technical profile deletes a social user account using **alternativ
253
245
| --------- | -------- | ----------- |
254
246
| Operation | Yes | The operation to be performed. Possible values: `Read`, `Write`, `DeleteClaims`, or `DeleteClaimsPrincipal`. |
255
247
| RaiseErrorIfClaimsPrincipalDoesNotExist | No | Raise an error if the user object does not exist in the directory. Possible values: `true` or `false`. |
256
-
| UserMessageIfClaimsPrincipalDoesNotExist | No | If an error is to be raised (see the RaiseErrorIfClaimsPrincipalDoesNotExist attribute description), specify the message to show to the user if user object does not exist. The value can be [localized](localization.md).|
257
248
| RaiseErrorIfClaimsPrincipalAlreadyExists | No | Raise an error if the user object already exists. Possible values: `true` or `false`.|
258
-
| UserMessageIfClaimsPrincipalAlreadyExists | No | If an error is to be raised (see RaiseErrorIfClaimsPrincipalAlreadyExists attribute description), specify the message to show to the user if user object already exists. The value can be [localized](localization.md).|
259
249
| ApplicationObjectId | No | The application object identifier for extension attributes. Value: ObjectId of an application. For more information, see [Use custom attributes in a custom profile edit policy](custom-policy-custom-attributes.md). |
260
250
| ClientId | No | The client identifier for accessing the tenant as a third party. For more information, see [Use custom attributes in a custom profile edit policy](custom-policy-custom-attributes.md)|
261
251
| IncludeClaimResolvingInClaimsHandling | No | For input and output claims, specifies whether [claims resolution](claim-resolver-overview.md) is included in the technical profile. Possible values: `true`, or `false` (default). If you want to use a claims resolver in the technical profile, set this to `true`. |
262
252
253
+
### Error messages
254
+
255
+
The following settings can be used to configure the error message displayed upon failure. The metadata should be configured in the [self-asserted](self-asserted-technical-profile.md) technical profile. The error messages can be [localized](localization.md).
256
+
257
+
| Attribute | Required | Description |
258
+
| --------- | -------- | ----------- |
259
+
| UserMessageIfClaimsPrincipalAlreadyExists | No | If an error is to be raised (see RaiseErrorIfClaimsPrincipalAlreadyExists attribute description), specify the message to show to the user if user object already exists. |
260
+
| UserMessageIfClaimsPrincipalDoesNotExist | No | If an error is to be raised (see the RaiseErrorIfClaimsPrincipalDoesNotExist attribute description), specify the message to show to the user if user object does not exist. |
261
+
262
+
263
+
## Next steps
264
+
265
+
See the following article, for example of using Azure AD technical profile:
266
+
267
+
-[Add claims and customize user input using custom policies in Azure Active Directory B2C](custom-policy-configure-user-input.md)
0 commit comments