Question: I have custom extension attributes in an Azure Active Directory (mapped via Azure AD Connect). The extension attributes on Azure AD take the form `extension_<uniqueid>_<attributename>`.

I want to expose several extension attributes to an application when the user logs in via Open ID Connect. The attributes should be included in the JWT token.

I tried using the approach from the [Microsoft Page](https://learn.microsoft.com/en-us/azure/active-directory/develop/active-directory-claims-mapping#example-create-and-assign-a-policy-to-include-the-employeeid-and-tenantcountry-as-claims-in-tokens-issued-to-a-service-principal) creating a policy and assigning it to the Service Principal ID of the application that wants to receive the token at login. 

These are the powershell commands I used.

```
Connect-AzureAD -Confirm

New-AzureADPolicy -Definition @('{"ClaimsMappingPolicy":{"Version":1,"IncludeBasicClaimSet":"true","ClaimsSchema":[{"Source":"user","ID":"extension_uniqueidretracted_extensionAttribute13","SamlClaimType":"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/extensionAttribute13","JwtClaimType":"MyCustomClaim1"},{"Source":"user","ID":"extension_uniqueidretracted_extensionAttribute14","SamlClaimType":"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/extensionAttribute14","JwtClaimType":"MyCustomClaim2"}]}}') -DisplayName "ExtensionAttributeMapping" -Type "ClaimsMappingPolicy"

Add-AzureADServicePrincipalPolicy -Id <ObjectId of the ServicePrincipal> -RefObjectId <ObjectId of the Policy>

```

Creating and assigning the policy works, but the attributes are still not included in the token.

What do I need to do to make this work?

Answer: 
1. Make sure that you set the acceptMappedClaims to true in the application's manifest in Azure AD.
2. Try using "ExtensionID":"extension\_uniqueidretracted\_extensionAttribute13" instead of "ID":"extension\_uniqueidretracted\_extensionAttribute13" in the ClaimsMappingPolicy.
You;d need to use the optional claims feature to get the information in the extension attributes available in the access tokens.

Please go through the doc [Configuring directory extension optional claims](https://learn.microsoft.com/en-us/azure/active-directory/develop/active-directory-optional-claims#configuring-directory-extension-optional-claims), which explains how this is achieved.