Some of our customers would like to pass use "claims" to manage their users in Azure/Entra ID, however, the "add a group claim" button is disabled; Any idea or help for why they cannot enable group claims?

Question

We're a SaaS provider using OAuth/OIDC to allow customers to sign in with Microsoft. We run a multi-tenant application, and our customers sign in using their own organization Microsoft account. When customers first sign in with Microsoft, sometimes they need to approve/whitelist our application to enable the sign in. Some of our customers would like to pass use "claims" to manage their users in Azure/Entra ID, however, the "add a group claim" button is disabled. Any idea or help for why they cannot enable group claims?

Accepted Answer

@John B

Thank you for posting this in Microsoft Q&A.

I understand you are trying to add new claims to your application, but the option is greyed out.

This is because there are claims defined using claim mapping policy through Graph or PowerShell. You need to remove any claim mapping policy from your applications to define new claims and attributes here.

You can check any existing claim mapping policy defined in your application using PowerShell commands.

Azure PowerShellCopy

Connect-AzureAD

User's image

You can remove claim mapping policy using

Azure PowerShellCopy

Remove-AzureADServicePrincipalPolicy -Id

Once the claim mapping policy has been removed from the application, you will get an option to add new claims.

Let me know if you have any further questions.

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

Share via

Some of our customers would like to pass use "claims" to manage their users in Azure/Entra ID, however, the "add a group claim" button is disabled; Any idea or help for why they cannot enable group claims?

0 additional answers