Why do Entra ID SAML claim transformations work differently for different claims?

Jens Bilgrav 0 Reputation points
2024-07-05T11:07:09.6133333+00:00

Scenario: In an Entra ID SAML-mediated SSO solution, I have to configure the identity provider to deliver a set of claims that all correspond to an email address. Depending on whether or not a specific extensionattribute contains a value (a set of initials), the email address must be constructed differently.

For this purpose, I have configured a claim transformation with the following pseudocode:

If 'user.extensionattributeXX' is not empty, then output 'user.extensionattributeXX'. Then join this output with @ followed by domain name Y.Z. Else (if 'user.extensionattributeXX' is empty), output 'user.userprincipalname'.

Now, for the default 'Unique User Identifier (Name ID)' claim, this works perfectly.

For my user, which does not have a value in extensionattributeXX, the claim output is simply my 'user.userprincipalname' as expected.

For a user that does have a value in extensionattributeXX, the claim output is XXXX@Y.Z, where 'XXXX' is the value in extensionattributeXX.

But here comes the odd part. I have to configure a claim specifically for the email address with the exact same claim transformation - but this does not work.

For my user, the claim output is always @Y.Z (corresponding to the "Else" statement in the pseudocode above), while the other user still gets XXXX@Y.Z.

Why is there a difference between the results of these two identical claim transformations? How do I achieve my goal?

Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
20,365 questions
0 comments No comments
{count} votes