Forum Discussion

buzzripper's avatar
buzzripper
Copper Contributor
Jun 26, 2025

Entra ID External - Custom Claims Provider help

Hi,

I'm working with Entra ID External identities, trying to get a 'Token Issuance Start' event in a Custom Claims Provider working correctly. I've got all the pieces in place (SPA, web api with endpoint set and configured, app registrations, basic login working successfully, etc). I just can't get the claims provider to call my claims endpoint. Tried so many different ways, get all different errors, all kinds of hours with and without ChatGPT, and still not working. I'm to the point where I'm ready to pay a consultant to help me get past this. But I'm just a solo dev working on a personal side project, I can't call an enterprise consulting company asking for an hour or two on a Zoom call, they don't deal with such miniscule jobs, at least none that I've called. I'm well past the point of making a stack overflow post or something like that, I need a one-on-one with someone familiar with Entra ID custom claims providers for External identities. But I'm guessing most folks with that knowledge are working for some big consulting firm that won't give me the time of day.


Can anyone suggest a small company that could help me, or maybe a place to post online for someone that might want to make a few bucks moonlighting on the side? I'm not looking for a handout, I'll pay a reasonable rate, I just can't afford (and pretty sure I won't need) more than a couple hours. If anyone knows of some site (or anyone interested yourself) please let me know, I'd be forever grateful, I'm at my wits end :)

 

Thanks,

Andy

microsoft entra

2 Replies

  • yhl's avatar
    yhl
    MCT
    Jul 23, 2026

    To configure custom extension is rather straight forward - but two area a lot of people missed are -
    1) configuring it in enterprise app > single sign-on > custom claim provider section.  

    2) giving admin consent to the app registration of the custom exension

     

    now that is on the EEID side, but the other side is the API and it entirely depends on what stack you have there, have you verified that the API can be called? 

    if you still need help - feel free to DM me

     

  • IdentitySecurist's avatar
    IdentitySecurist
    Copper Contributor
    Jul 22, 2026

    Before looking for a consultant, I'd recommend verifying a few common configuration issues that prevent the Token Issuance Start event from invoking the claims endpoint:

    • Make sure the Custom Authentication Extension is successfully created and associated with the Token Issuance Start event.
    • Verify that the API endpoint is publicly reachable over HTTPS and returns the expected response format.
    • Confirm that the API registration exposes the required permission and that admin consent has been granted.
    • Ensure the authentication event is actually triggered by the user flow you're testing, as not every sign-in flow invokes the extension.
    • Check the Entra audit logs and sign-in logs for any errors related to authentication events or custom extensions, as they often provide more detailed failure information than the client.

    If the endpoint is never being called, it's usually a configuration or event-binding issue rather than a problem with the API itself.

    If you've already validated all of the above and the endpoint is still never invoked, I'd recommend opening a Microsoft support case. They can verify whether the authentication event is being processed correctly on the service side and identify any tenant-specific issues that aren't visible from the portal.

    If this resolves your issue, please consider marking the answer as the solution so it can help others facing the same problem.