Entra ID External - Custom Claims Provider help

Before looking for a consultant, I'd recommend verifying a few common configuration issues that prevent the Token Issuance Start event from invoking the claims endpoint:

• Make sure the Custom Authentication Extension is successfully created and associated with the Token Issuance Start event.
• Verify that the API endpoint is publicly reachable over HTTPS and returns the expected response format.
• Confirm that the API registration exposes the required permission and that admin consent has been granted.
• Ensure the authentication event is actually triggered by the user flow you're testing, as not every sign-in flow invokes the extension.
• Check the Entra audit logs and sign-in logs for any errors related to authentication events or custom extensions, as they often provide more detailed failure information than the client.

If the endpoint is never being called, it's usually a configuration or event-binding issue rather than a problem with the API itself.

If you've already validated all of the above and the endpoint is still never invoked, I'd recommend opening a Microsoft support case. They can verify whether the authentication event is being processed correctly on the service side and identify any tenant-specific issues that aren't visible from the portal.

If this resolves your issue, please consider marking the answer as the solution so it can help others facing the same problem.