App Registration query - OIDC connection

Question

Question,&nbsp;I am trying to establish if there is a way using an app registration/ enterprise app so that a user can authenticate to a different ID (so authentication would use something other than their UPN for that specific app)&nbsp;I know it's best practice to use the UPN when authenticating from the IdP (Entra ID) to the SP and not use the email address as an example and the majority of apps I have configured already set UPN to match the attribute with the SP.&nbsp;Any ideas?&nbsp;I was looking at custom SAML tokens but got a bit lost and since this is an OIDC app (OpenID Connect and OAuth) I don't know if it applies.

joe stocker · Answer

DeanH&nbsp;I believe you can accomplish that through Token Configuration &gt; Optional ClaimsReference:&nbsp;https://learn.microsoft.com/en-us/entra/identity-platform/optional-claims&nbsp;"Users signing in with an&nbsp;alternate login ID&nbsp;shouldn't be shown their User Principal Name (UPN). Instead, use the following ID token claims for displaying sign-in state to the user:&nbsp;preferred_username&nbsp;or&nbsp;unique_name&nbsp;for v1 tokens and&nbsp;preferred_username&nbsp;for v2 tokens."Reference:&nbsp;https://learn.microsoft.com/en-us/entra/identity-platform/optional-claims-reference#v10-and-v20-optional-claims-set

Forum Discussion

App Registration query - OIDC connection