title: How to add custom claims to Azure AD authenticated user in ASP.Net Core application?
body: <p>We are building a ASP.net core Web API with Angular SPA client.  For Authentication we have implemented Azure AD with multi tenants.  For the Web API authentication/authorization we have followed <a href="https://github.com/Azure-Samples/active-directory-dotnet-native-aspnetcore-v2/tree/master/1.%20Desktop%20app%20calls%20Web%20API" rel="nofollow noreferrer">this Microsoft sample</a>.  This uses the <code>Microsoft.Identity.Web</code> MSAL library for authenticating the authorisation code that originated from the Angular SPA.  On the Azure AD application registration we manage the correct scope of the application, but we are not able to understand how claims are managed.</p>
  <p>In previous applications I had run the authentication server <code>IdentityServer4</code> as middleware in my application, allowing the authentication and issuing of claims in my application.  I was using <code>UserManager</code> to add or remove claims on the User.  Claims information was stored in the User tables of my database, and were then included in the issued cookie and available to the SPA and the Web API.</p>
  <p>In the current application we are fully relying on Azure AD, and now I feel I am missing a piece of the puzzle to manage the user claims (and their inclusion on the cookie/token).  <strong>Question:</strong> How can I manage claims that are specific to our application while user management and authentication takes place on Azure AD rather than in my application?</p>
  <p>To clarify: <a href="https://docs.microsoft.com/en-us/azure/architecture/multitenant-identity/app-roles#roles-using-an-application-role-manager" rel="nofollow noreferrer">This Microsoft document</a> mentions three ways of using application roles: Azure AD App roles, Azure AD Security Groups and Application Role manager.  It's the last one I feel is the correct functionality I need:</p>
  <blockquote>
  <p>With this approach, application roles are not stored in Azure AD at all. Instead, the application stores the role assignments for each user in its own DB — for example, using the RoleManager class in ASP.NET Identity.</p>
  </blockquote>
  <hr />
  <p><em>A small selection of the documentation I have reviewed but didn't give me the answers:</em></p>
  <ul>
  <li><p><a href="https://docs.microsoft.com/en-us/azure/architecture/multitenant-identity/app-roles#roles-using-an-application-role-manager" rel="nofollow noreferrer">This previously linked Microsoft document</a> does mention using the <em>RoleManager</em> class in ASP.NET Identity, but does not explain how to implement this as integration with Azure AD such that the cookies/tokens include the roles (or roles converted to claims).</p>
  </li>
  <li><p>I have read about using MS Graph <a href="https://docs.microsoft.com/en-us/previous-versions/azure/ad/graph/howto/azure-ad-graph-api-directory-schema-extensions" rel="nofollow noreferrer">schema extensions</a> and <a href="https://rasmustherkelsen.wordpress.com/2019/12/09/custom-claims-in-azure-ad/" rel="nofollow noreferrer">including these in claims</a> however, the article also states that <em>any</em> application with consent can read and write these extended properties.  Implying this is not a secure way to provide any claim to the application as the values could be touched from outside the application</p>
  </li>
  <li><p><a href="https://docs.microsoft.com/en-us/azure/active-directory/develop/scenario-protected-web-api-verification-scope-app-roles" rel="nofollow noreferrer">Documentation</a> explaining how to verify user claims.</p>
  </li>
  <li><p><a href="https://docs.microsoft.com/en-us/azure/architecture/multitenant-identity/app-roles#roles-using-an-application-role-manager" rel="nofollow noreferrer">Tailspin scenario</a>, mentions using roles on the application rather than security groups.  But there is no indication or hint how this is included as claims in Azure AD.  And following <a href="https://docs.microsoft.com/en-us/azure/active-directory/develop/howto-add-app-roles-in-azure-ad-apps" rel="nofollow noreferrer">this</a> it's clear that it's not controlled in the application.</p>
  </li>
  <li><p><a href="https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-saml-claims-customization" rel="nofollow noreferrer">This document</a> and <a href="https://stackoverflow.com/questions/58940576/azure-ad-custom-claims-in-jwt">this</a> explains about transforming claims or adding custom claims, but this is basis conditions on the user account rather than the application setting the claims.  These conditions would also need to be managed on the domain rather than in the application.</p>
  </li>
  <li><p><a href="https://stackoverflow.com/questions/62532800/adding-claims-to-azure-ad-authentication">Similar question</a>?  But no answer.</p>
  </li>
  </ul>