Forum Discussion
Microsoft SSO SAML Assertion Claims
While getting the assertions back from SAML Assertion Claims, I have configured the user.country & assigned some value in the field. But while getting the claim we are reading the some different value like "IN" ? can I know does the user.country claim supports or not during the claim?
2 Replies
IN is just the standard ISO 2-letter code Entra outputs for country. Working as intended.
If the app needs the full country name, the easiest fix is parsing the ISO code app-side. Otherwise populate extensionAttribute1 with the full string and map that as the claim source instead. You could mess with claim transformations in the portal, but it gets messy fast.
Also check the account properties in Entra just in case — make sure country is actually set and you're not looking at usageLocation.
Yes, user.country is supported as a SAML claim source. Your screenshot maps that attribute to an outgoing claim named region; naming the claim region does not convert its value into a full country name. Microsoft also documents country values such as US, so receiving a code does not by itself indicate an unsupported attribute. First, inspect the country property of the exact user signing in, in the tenant containing this enterprise application. Do not confuse it with usageLocation, which is a separate property. Save the claim configuration, start a fresh sign-in, and inspect the actual region attribute in the resulting SAML assertion before the application processes it. If the assertion is correct but the application displays something else, investigate its mapping. If a different representation is required, configure an appropriate supported transformation or directory extension. Share only redacted claim details, never the complete authentication token.
