title: How to pass custom extension attributes from Azure Active Directory in JWT token at login?
body: <p>I have custom extension attributes in an Azure Active Directory (mapped via Azure AD Connect). The extension attributes on Azure AD take the form <code>extension_&lt;uniqueid&gt;_&lt;attributename&gt;</code>.</p>
  
  <p>I want to expose several extension attributes to an application when the user logs in via Open ID Connect. The attributes should be included in the JWT token.</p>
  
  <p>I tried using the approach from the <a href="https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-claims-mapping#example-create-and-assign-a-policy-to-include-the-employeeid-and-tenantcountry-as-claims-in-tokens-issued-to-a-service-principal" rel="nofollow noreferrer">Microsoft Page</a> creating a policy and assigning it to the Service Principal ID of the application that wants to receive the token at login. </p>
  
  <p>These are the powershell commands I used.</p>
  
  <pre><code>Connect-AzureAD -Confirm
  
  New-AzureADPolicy -Definition @('{"ClaimsMappingPolicy":{"Version":1,"IncludeBasicClaimSet":"true","ClaimsSchema":[{"Source":"user","ID":"extension_uniqueidretracted_extensionAttribute13","SamlClaimType":"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/extensionAttribute13","JwtClaimType":"MyCustomClaim1"},{"Source":"user","ID":"extension_uniqueidretracted_extensionAttribute14","SamlClaimType":"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/extensionAttribute14","JwtClaimType":"MyCustomClaim2"}]}}') -DisplayName "ExtensionAttributeMapping" -Type "ClaimsMappingPolicy"
  
  Add-AzureADServicePrincipalPolicy -Id &lt;ObjectId of the ServicePrincipal&gt; -RefObjectId &lt;ObjectId of the Policy&gt;
  </code></pre>
  
  <p>Creating and assigning the policy works, but the attributes are still not included in the token.</p>
  
  <p>What do I need to do to make this work?</p>