Forum Discussion

MustangProgrammer's avatar
MustangProgrammer
Copper Contributor
Sep 29, 2025

Creating Claims Mapping Policy in Entra ID

I am attempting to create a Claims Mapping Policy using PowerShell, Entra ID and Microsoft Graph via a script or a PowerShell Window,  In neither case, I was able to do it.  

The script is:

# Define the Application (Client) ID and Secret

$applicationClientId = 'XXXXXXXXXXX' # Application (Client) ID

$applicationClientSecret = 'XXXXXXXXXXX' # Application Secret Value

$tenantId = 'XXXXXXXXXXXX' # Tenant ID

Connect-Entra -TenantId $tenantId -ClientSecretCredential $clientSecretCredential

$params = @{

    definition = @(

    '{"ClaimsMappingPolicy":{"Version":1,"IncludeBasicClaimSet":"false","ClaimsSchema":[{"Source":"user","onpremisesssamaccountname":"name","SamlClaimType": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name"}]}}'

)

displayName = "ClaimTest"

}

New-MgPolicyClaimMappingPolicy -BodyParameter $params

Get-MgPolicyClaimMappingPolicy

Disconnect-Entra

 

I keep getting the error:


New-MgPolicyClaimMappingPolicy : One or more errors occurred.
At C:\Users\eigog\Documents\Poweshell Scripts\test.ps1:24 char:1
+ New-MgPolicyClaimMappingPolicy -BodyParameter $params
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [New-MgPolicyClaimMappingPolicy_Create], AggregateException
    + FullyQualifiedErrorId : System.AggregateException,Microsoft.Graph.PowerShell.Cmdlets.NewMgPolicyClaimMappingPolicy_Create

 

I don't understand, because this was similar to the example they gave here:  https://learn.microsoft.com/en-us/entra/identity-platform/claims-customization-powershell

 

And yes, I tried to do it manually in a PowerShell window with my credentials and I tried the beta version as well.  The application does have the scope of Policy.ReadWrite.ApplicationConfiguration.

I can't seem to see the error.  Can anyone see something I'm missing or point me in a direction? 

 

Thanks

Enterprise Applications
entra id

1 Reply

  • LainRobertson's avatar
    LainRobertson
    Silver Contributor
    Sep 30, 2025

    Hi MustangProgrammer​,

     

    The format of your claim is incorrect, which based on version 2.30.0 of the commandlet does indeed show up in the error:

     

     

     

    The specific issue is you haven't provided the key-value pair correctly, where it is supposed to be in the format of "ID":"attributeName". Here's the correct format:

     

    $params = @{
    definition = @(
        '{"ClaimsMappingPolicy":{"Version":1,"IncludeBasicClaimSet":"false","ClaimsSchema":[{"Source":"user","ID":"onpremisesssamaccountname","SamlClaimType": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name"}]}}'
    )

    displayName = "ClaimTest"
}

     

    Which is then accepted by Graph, as demonstrated below:

     

     

    Cheers,

    Lain

Resources