Microsoft SSO SAML Assertion Claims

You are right, in Entra ID (Azure AD), the country/c attribute on users and the corresponding claim is the ISO 3166‑1 alpha‑2 two‑letter code (e.g. IN for India). That is by design and “working as intended”.

IN is just the standard ISO 2-letter code Entra outputs for country. Working as intended.

If the app needs the full country name, the easiest fix is parsing the ISO code app-side. Otherwise populate extensionAttribute1 with the full string and map that as the claim source instead. You could mess with claim transformations in the portal, but it gets messy fast.

Also check the account properties in Entra just in case — make sure country is actually set and you're not looking at usageLocation.

Yes, user.country is supported as a SAML claim source. Your screenshot maps that attribute to an outgoing claim named region; naming the claim region does not convert its value into a full country name. Microsoft also documents country values such as US, so receiving a code does not by itself indicate an unsupported attribute. First, inspect the country property of the exact user signing in, in the tenant containing this enterprise application. Do not confuse it with usageLocation, which is a separate property. Save the claim configuration, start a fresh sign-in, and inspect the actual region attribute in the resulting SAML assertion before the application processes it. If the assertion is correct but the application displays something else, investigate its mapping. If a different representation is required, configure an appropriate supported transformation or directory extension. Share only redacted claim details, never the complete authentication token.