title: ADB2C custom policy - Writing a federated user is not setting the correct UPN in user profile
body: <p>We are allowing External Azure AD users to signup and login to our application via a <a href="https://docs.microsoft.com/en-us/azure/active-directory-b2c/identity-provider-azure-ad-multi-tenant?pivots=b2c-custom-policy" rel="nofollow noreferrer">custom policy</a>. The shell user that is being created in our adb2c directory does not get the UPN that I want in the user profile (<strong>screen shot</strong> below). I want the upn to be the value of the <strong>federated_upn</strong> claim which is <strong>numero1@notecorp111.onmicrosoft.com</strong>  but it is setting the upn to the value of the <strong>email</strong> claim which is <strong>correo1@notecorp111.onmicrosoft.com</strong>.  Can you let me know what I'm doing wrong?  Thanks!</p>
  <pre><code>claims:
  alternativeSecurityId: &lt;Guid&gt;
  userPrincipalName: cpim_&lt;guid&gt;@tenantname.onmicrosoft.com
  email: correo1@notecorp111.onmicrosoft.com
  federated_upn: numero1@notecorp111.onmicrosoft.com
  </code></pre>
  <p>Technical Profile:</p>
  <pre><code>    &lt;TechnicalProfile Id=&quot;AAD-UserWriteUsingAlternativeSecurityId&quot;&gt;
        &lt;Metadata&gt;
          &lt;Item Key=&quot;Operation&quot;&gt;Write&lt;/Item&gt;
          &lt;Item Key=&quot;RaiseErrorIfClaimsPrincipalAlreadyExists&quot;&gt;true&lt;/Item&gt;
          &lt;Item Key=&quot;UserMessageIfClaimsPrincipalAlreadyExists&quot;&gt;You are already registered, please press the back button and sign in instead.&lt;/Item&gt;
        &lt;/Metadata&gt;
        &lt;IncludeInSso&gt;false&lt;/IncludeInSso&gt;
        &lt;InputClaims&gt;
          &lt;InputClaim ClaimTypeReferenceId=&quot;AlternativeSecurityId&quot; PartnerClaimType=&quot;alternativeSecurityId&quot; Required=&quot;true&quot; /&gt;
        &lt;/InputClaims&gt;
           &lt;!-- Required claims --&gt;
          &lt;PersistedClaim ClaimTypeReferenceId=&quot;alternativeSecurityId&quot; /&gt;
          &lt;PersistedClaim ClaimTypeReferenceId=&quot;userPrincipalName&quot; /&gt;
          &lt;PersistedClaim ClaimTypeReferenceId=&quot;mailNickName&quot; DefaultValue=&quot;unknown&quot; /&gt;
          &lt;PersistedClaim ClaimTypeReferenceId=&quot;displayName&quot; DefaultValue=&quot;unknown&quot; /&gt;
          &lt;PersistedClaim ClaimTypeReferenceId=&quot;email&quot;  PartnerClaimType=&quot;mail&quot; /&gt; 
          &lt;PersistedClaim ClaimTypeReferenceId=&quot;federated_upn&quot; PartnerClaimType=&quot;signInNames.emailAddress&quot; /&gt;
        &lt;/PersistedClaims&gt;
        &lt;OutputClaims&gt;
          &lt;OutputClaim ClaimTypeReferenceId=&quot;objectId&quot; /&gt;
          &lt;OutputClaim ClaimTypeReferenceId=&quot;newUser&quot; PartnerClaimType=&quot;newClaimsPrincipalCreated&quot; /&gt;
        &lt;/OutputClaims&gt;
        &lt;IncludeTechnicalProfile ReferenceId=&quot;AAD-Common&quot; /&gt;
        &lt;UseTechnicalProfileForSessionManagement ReferenceId=&quot;SM-AAD&quot; /&gt;
      &lt;/TechnicalProfile&gt;
  
  
      &lt;TechnicalProfile Id=&quot;AADCommon-OpenIdConnect&quot;&gt;
        &lt;DisplayName&gt;Multi-Tenant AAD&lt;/DisplayName&gt;
        &lt;Description&gt;Login with your Contoso account&lt;/Description&gt;
        &lt;Protocol Name=&quot;OpenIdConnect&quot;/&gt;
        &lt;Metadata&gt;
          &lt;Item Key=&quot;METADATA&quot;&gt;https://login.microsoftonline.com/common/v2.0/.well-known/openid-configuration&lt;/Item&gt;
          &lt;Item Key=&quot;client_id&quot;&gt;xxxxxxxxxx&lt;/Item&gt;
          &lt;Item Key=&quot;response_types&quot;&gt;code&lt;/Item&gt;
          &lt;Item Key=&quot;scope&quot;&gt;openid profile email&lt;/Item&gt;
          &lt;Item Key=&quot;response_mode&quot;&gt;form_post&lt;/Item&gt;
          &lt;Item Key=&quot;HttpBinding&quot;&gt;POST&lt;/Item&gt;
          &lt;Item Key=&quot;UsePolicyInRedirectUri&quot;&gt;false&lt;/Item&gt;
          &lt;Item Key=&quot;DiscoverMetadataByTokenIssuer&quot;&gt;true&lt;/Item&gt;
           &lt;Item Key=&quot;ValidTokenIssuerPrefixes&quot;&gt;https://login.microsoftonline.com/&lt;/Item&gt;
        &lt;/Metadata&gt;
        &lt;CryptographicKeys&gt;
          &lt;Key Id=&quot;client_secret&quot; StorageReferenceId=&quot;B2C_1A_XXXXX&quot;/&gt;
        &lt;/CryptographicKeys&gt;
        &lt;OutputClaims&gt;
          &lt;OutputClaim ClaimTypeReferenceId=&quot;issuerUserId&quot; PartnerClaimType=&quot;oid&quot;/&gt;
          &lt;OutputClaim ClaimTypeReferenceId=&quot;federated_upn&quot; PartnerClaimType=&quot;upn&quot;/&gt;
  &lt;OutputClaim ClaimTypeReferenceId=&quot;signInNames.emailAddress&quot; PartnerClaimType=&quot;upn&quot;/&gt;       
          &lt;OutputClaim ClaimTypeReferenceId=&quot;email&quot; /&gt;
          &lt;OutputClaim ClaimTypeReferenceId=&quot;displayName&quot; PartnerClaimType=&quot;name&quot; /&gt;
          &lt;OutputClaim ClaimTypeReferenceId=&quot;tenantId&quot; PartnerClaimType=&quot;tid&quot;/&gt;
          &lt;OutputClaim ClaimTypeReferenceId=&quot;identityProvider&quot; PartnerClaimType=&quot;iss&quot; /&gt;            
        &lt;/OutputClaims&gt;
        &lt;OutputClaimsTransformations&gt;
          &lt;OutputClaimsTransformation ReferenceId=&quot;CreateRandomUPNUserName&quot;/&gt;
          &lt;OutputClaimsTransformation ReferenceId=&quot;CreateUserPrincipalName&quot;/&gt;
          &lt;OutputClaimsTransformation ReferenceId=&quot;CreateAlternativeSecurityId&quot;/&gt;
          &lt;OutputClaimsTransformation ReferenceId=&quot;CreateSubjectClaimFromAlternativeSecurityId&quot;/&gt;
        &lt;/OutputClaimsTransformations&gt;
        &lt;UseTechnicalProfileForSessionManagement ReferenceId=&quot;SM-SocialLogin&quot;/&gt;
      &lt;/TechnicalProfile&gt;
  </code></pre>
  <p><strong>Screen shot of the user profile here:</strong>
  <a href="https://i.stack.imgur.com/BYbEI.png" rel="nofollow noreferrer">adb2c user profile</a></p>