Skip to content

Commit 895eba4

Browse files
committed
updated sign in steps
1 parent d667b9e commit 895eba4

File tree

7 files changed

+5
-15
lines changed

7 files changed

+5
-15
lines changed

articles/active-directory/develop/jwt-claims-customization.md

Lines changed: 5 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -24,25 +24,21 @@ These JSON Web tokens (JWT) used by OIDC and OAuth applications contain pieces o
2424

2525
[!INCLUDE [portal updates](~/articles/active-directory/includes/portal-update.md)]
2626

27-
To view or edit the claims issued in the JWT to the application, open the application in Azure portal. Then select **Single sign-on** blade in the left-hand menu and open the **Attributes & Claims** section.
27+
To view or edit the claims issued in the JWT to the application:
2828

29-
:::image type="content" source="./media/jwt-claims-customization/attributes-claims.png" alt-text="Screenshot of opening the Attributes & Claims section in the Azure portal.":::
29+
1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [Cloud Application Administrator](../roles/permissions-reference.md#cloud-application-administrator).
30+
1. Browse to **Identity** > **Applications** > **Enterprise applications** > **All applications**.
31+
1. Select the application, select **Single sign-on** in the left-hand menu, and then select **Edit** in the **Attributes & Claims** section.
3032

3133
An application may need claims customization for various reasons. For example, when an application requires a different set of claim URIs or claim values. Using the **Attributes & Claims** section, you can add or remove a claim for your application. You can also create a custom claim that is specific for an application based on the use case.
3234

3335
The following steps describe how to assign a constant value:
3436

35-
1. Sign in to the [Azure portal](https://portal.azure.com).
36-
1. In the **Attributes & Claims** section, Select **Edit** to edit the claims.
37-
1. Select the required claim that you want to modify.
37+
1. Select the claim that you want to modify.
3838
1. Enter the constant value without quotes in the **Source attribute** as per your organization, and then select **Save**.
3939

40-
:::image type="content" source="./media/jwt-claims-customization/customize-claim.png" alt-text="Screenshot of customizing a claim in the Azure portal.":::
41-
4240
The Attributes overview displays the constant value.
4341

44-
:::image type="content" source="./media/jwt-claims-customization/claims-overview.png" alt-text="Screenshot of displaying claims in the Azure portal.":::
45-
4642
## Special claims transformations
4743

4844
You can use the following special claims transformations functions.
@@ -70,8 +66,6 @@ To apply a transformation to a user attribute:
7066
1. **Treat source as multivalued** indicates whether the transform is applied to all values or just the first. By default, the first element in a multi-value claim is applied the transformations. When you check this box, it ensures it's applied to all. This checkbox is only enabled for multi-valued attributes. For example, `user.proxyaddresses`.
7167
1. To apply multiple transformations, select **Add transformation**. You can apply a maximum of two transformations to a claim. For example, you could first extract the email prefix of the `user.mail`. Then, make the string upper case.
7268

73-
:::image type="content" source="./media/jwt-claims-customization/sso-saml-multiple-claims-transformation.png" alt-text="Screenshot of claims transformation.":::
74-
7569
You can use the following functions to transform claims.
7670

7771
| Function | Description |
@@ -187,12 +181,8 @@ For example, Britta Simon is a guest user in the Contoso tenant. Britta belongs
187181

188182
First, the Microsoft identity platform verifies whether Britta's user type is **All guests**. Because the type is **All guests**, the Microsoft identity platform assigns the source for the claim to `user.extensionattribute1`. Second, the Microsoft identity platform verifies whether Britta's user type is **AAD guests**. Because the type is **All guests**, the Microsoft identity platform assigns the source for the claim to `user.mail`. Finally, the claim is emitted with a value of `user.mail` for Britta.
189183

190-
:::image type="content" source="./media/jwt-claims-customization/sso-saml-user-conditional-claims.png" alt-text="Screenshot of claims conditional configuration.":::
191-
192184
As another example, consider when Britta Simon tries to sign in using the following configuration. Azure AD first evaluates all conditions with source `Attribute`. The source for the claim is `user.mail` when Britta's user type is **AAD guests**. Next, Azure AD evaluates the transformations. Because Britta is a guest, `user.extensionattribute1` is the new source for the claim. Because Britta is in **AAD guests**, `user.othermail` is the new source for this claim. Finally, the claim is emitted with a value of `user.othermail` for Britta.
193185

194-
:::image type="content" source="./media/jwt-claims-customization/sso-saml-user-conditional-claims-2.png" alt-text="Screenshot of more claims conditional configuration.":::
195-
196186
As a final example, consider what happens if Britta has no `user.othermail` configured or it's empty. The claim falls back to `user.extensionattribute1` ignoring the condition entry in both cases.
197187

198188
## Security considerations

0 commit comments

Comments
 (0)