title: Azure Active Directory override claim value in OIDC id-token
body: <p>I'm looking for a way to ensure that the unique_name claim value is always the user email for a specific app in AAD which is accessed via SSO. I've noticed that for users which have an AAD account, the unique_name claim value is the email address, but for external users (invited to the directory) it is prefixed by &quot;live.com#&quot; (e.g. live.com#email@domain.com). The application uses the OIDC protocol. I've been trying different things from Microsoft docs:</p>
  <ol>
  <li>Setting a different source for the unique_name claim
  <a href="https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-saml-claims-customization" rel="nofollow noreferrer">https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-saml-claims-customization</a>
  (I'm not sure if this applies, given the app uses OIDC, not SAML)</li>
  </ol>
  <p>(By the way, that documentation is a bit out of date because I found that the &quot;User Attributes &amp; Claims&quot; section is now in SSO <a href="https://docs.microsoft.com/en-us/answers/questions/248748/cant39-find-the-34user-attributes-amp-claims34-sec.html" rel="nofollow noreferrer">https://docs.microsoft.com/en-us/answers/questions/248748/cant39-find-the-34user-attributes-amp-claims34-sec.html</a>)</p>
  <ol start="2">
  <li>Building a claim-mapping policy
  <a href="https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-claims-mapping" rel="nofollow noreferrer">https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-claims-mapping</a></li>
  </ol>
  <p>None of these worked.</p>
  <p>I know this would be trivial in AAD B2C with custom policies. Is it possible to override the unique_name claim with the email claim in AAD?</p>
  <hr />
  <p>Update 07/01/2022</p>
  <p>After further investigation I found that the unique_name claim is only supported in v1 tokens <a href="https://docs.microsoft.com/en-us/azure/active-directory/develop/id-tokens" rel="nofollow noreferrer">https://docs.microsoft.com/en-us/azure/active-directory/develop/id-tokens</a>, <a href="https://github.com/MicrosoftDocs/azure-docs/issues/62971" rel="nofollow noreferrer">https://github.com/MicrosoftDocs/azure-docs/issues/62971</a> (the current version is v2) and it's transformed into &quot;http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name&quot; by the ADAL client. This customization I'm after is for a legacy .NET app which uses ADAL on the v1 AAD endpoint.
  The only way I can think of how to achieve this is via a claim-mapping policy, however I haven't been able to do make it work. Any ideas would be appreciated.</p>