Azure B2C：自定义声明未通过自定义策略写入 AAD

Question

It seems that I've hit a road block when it comes to writing custom claims to Azure Active Directory (AAD). I'm trying to write the organization into ADD, but it appears that when I query the users via Graph API, I don't see any trace of the organization data. I'm wondering if there's something off with how I attempted to write the data or there's a techincal detail that I'm not aware of that can cause this issue?

Here's the custom claim that I want to save to AAD.

      <ClaimType Id="extension_organization">
        <DisplayName>Organization Name</DisplayName>
        <DataType>string</DataType>
        <UserHelpText>Name of admin's organization.</UserHelpText>
        <UserInputType>TextBox</UserInputType>
      </ClaimType>

And here is where I'm writing the claims (it's pretty much what you would see in the examples):

        <TechnicalProfile Id="AAD-UserWriteUsingLogonEmail">
          <Metadata>
            <Item Key="Operation">Write</Item>
            <Item Key="RaiseErrorIfClaimsPrincipalAlreadyExists">true</Item>
          </Metadata>
          <IncludeInSso>false</IncludeInSso>
          <InputClaims>
            <InputClaim ClaimTypeReferenceId="email" PartnerClaimType="signInNames.emailAddress" Required="true" /> 
          </InputClaims>
          <PersistedClaims>
            <!-- Required claims -->
            <PersistedClaim ClaimTypeReferenceId="email" PartnerClaimType="signInNames.emailAddress" />
            <PersistedClaim ClaimTypeReferenceId="newPassword" PartnerClaimType="password"/>
            <PersistedClaim ClaimTypeReferenceId="displayName" DefaultValue="unknown" />
            <PersistedClaim ClaimTypeReferenceId="passwordPolicies" DefaultValue="DisablePasswordExpiration" />
  
            <!-- Optional claims. -->
            <PersistedClaim ClaimTypeReferenceId="givenName" />
            <PersistedClaim ClaimTypeReferenceId="surname" />
            <PersistedClaim ClaimTypeReferenceId="extension_organization" /> 
          </PersistedClaims>
          <OutputClaims>
            <OutputClaim ClaimTypeReferenceId="objectId" />
            <OutputClaim ClaimTypeReferenceId="newUser" PartnerClaimType="newClaimsPrincipalCreated" />
            <OutputClaim ClaimTypeReferenceId="authenticationSource" DefaultValue="localAccountAuthentication" />
            <OutputClaim ClaimTypeReferenceId="userPrincipalName" />
            <OutputClaim ClaimTypeReferenceId="signInNames.emailAddress" />
          </OutputClaims>
          <IncludeTechnicalProfile ReferenceId="AAD-Common" />
          <UseTechnicalProfileForSessionManagement ReferenceId="SM-AAD" />
        </TechnicalProfile>

On an interesting note, it seems that not even the e-mail can be seen.

Answer 1

When querying the Graph API for custom/extension attributes, you will need to make sure you select the extension attributes with the following syntax:

extension_{b2cExtensionsAppId}_organization

Where {b2cExtensionsAppId} is the Application/Client ID for the application in your B2C tenant that is automatically generated:

b2c-extensions-app. Do not modify. Used by AADB2C for storing user data.

Edit - Remove the dashes (-) from the Extensions Application/Client ID

79af1ae0-cacb-401a-9a42-1f2178adc0ef gets converted to 79af1ae0cacb401a9a421f2178adc0ef .

Example: b2c_79af1ae0cacb401a9a421f2178adc0ef_organization