When using Custom Domain , is there a claim that will reflect the custom domain the identity is assigned?

Question

When using Custom Domain , is there a claim that will reflect the custom domain the identity is assigned?

Martin Kallukalam 535

Scenario:
I have 3 custom domains

domain1

domain2

domain3

Is there a way to get the domainname as a claim in id token and access token when a user gets a token using interactive login (auth code grant flow)

Martin Kallukalam 535 Reputation points

2025-04-17T19:45:32.66+00:00

fyi. I understand domain name comes as part of the unique name/upn but I am looking at ways where the claim is explicit like the realm claim in oidc
Sanoop M 4,350 Reputation points Moderator

2025-04-21T08:13:18.5333333+00:00

Hello @Martin Kallukalam,

Please note that we can pass email id, UPN, family_name, Onprem_sid, etc as a claim in ID token as well as Access token, but specifically we cannot pass the domain name as a claim in ID token and Access token.

Please note that the only way to get the domain names is to pass UPN/Email ID as Claims and get the domain name from that passed claims.

Please refer to the below documents to know in detail about Access tokens and ID tokens.

Access tokens in the Microsoft identity platform - Microsoft identity platform | Microsoft Learn

ID tokens in the Microsoft identity platform - Microsoft identity platform | Microsoft Learn

Tokens and claims overview - Microsoft identity platform | Microsoft Learn

I hope the above provided information is helpful. Please let me know if you have any additional queries.
Sanoop M 4,350 Reputation points Moderator

2025-04-22T12:11:32.2933333+00:00

Hello @Martin Kallukalam,

I am following up to check whether if you had a chance to review my below answer and please let me know if you have any queries.

I will be happy in answering to your queries.
Sanoop M 4,350 Reputation points Moderator

2025-04-23T08:56:44.97+00:00

Hello @Martin Kallukalam,

Since we didn't receive your response on my below answer, I am following up to check whether if you had a chance to review my below answer and please let me know if you have any queries.

I will be happy in answering to your queries.
Martin Kallukalam 535 Reputation points

2025-04-23T12:42:16.4066667+00:00

I did review the response and I do have couple of follow up Qs. I will post them shortly.
Sanoop M 4,350 Reputation points Moderator

2025-04-25T05:07:02.9933333+00:00

Hello @Martin Kallukalam,

Thank you for your response.

Please post your queries here so that I can review it and answer your queries accordingly.
Sanoop M 4,350 Reputation points Moderator

2025-04-28T03:25:15.5966667+00:00

Hello @Martin Kallukalam,

I am following up to check whether if you have any additional queries, please post your queries here so that I can look into it and answer your queries accordingly.
Martin Kallukalam 535 Reputation points

2025-04-29T19:13:36.7333333+00:00
When you say get the domain name from the passed claims..do you mean extract the domain name from claim in the application code?

Or does Azure AD have a way to do that and include the domainname as a claim?

How about the attribute user.dnsdomainname
Sanoop M 4,350 Reputation points Moderator

2025-05-06T13:28:49.73+00:00

Hello @Martin Kallukalam ,

Thank you for your response.

Yes the only way to get the domain name from the passed claims is to extract the domain names from the application code.

The user.dnsdomainname attribute typically refers to the domain name associated with the user's account in an On-Premises Active Directory. In authentication and authorization processes, particularly within federated identity solutions or Single Sign-On (SSO) setups, this attribute user.dnsdomainname can be passed in claims to identify the user's domain.

Below is the Screenshot of some of the attributes which can be passed in claims and their description. I have highlighted the description of the User.dnsdomainname attribute.

Please let me know if you have any other queries.
Martin Kallukalam 535 Reputation points

2025-05-06T18:03:58.68+00:00

If user.dnsdomainame is only reliable if the user gets authenticated via a federated system, how do I get the domain name when there is no federation, such as user identity is created on Azure AD and user is authenticating using those credential that exists on azure ad ?
Anonymous

2025-05-09T03:48:40.1266667+00:00

Hello @@Martin Kallukalam, Did you get a chance to verify my comment and let me know if its helpful?

We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution, please do share that same with the community as it can be helpful to others. Otherwise, please respond with more details and we will try to help.
Anonymous

2025-05-12T05:09:48.2266667+00:00

Hello @@Martin Kallukalam, Did you get a chance to verify my comment and let me know if its helpful?

We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution, please do share that same with the community as it can be helpful to others. Otherwise, please respond with more details and we will try to help.

1 answer

Your answer

Martin Kallukalam 535 Reputation points

2025-04-17T19:45:32.66+00:00

fyi. I understand domain name comes as part of the unique name/upn but I am looking at ways where the claim is explicit like the realm claim in oidc
Sanoop M 4,350 Reputation points Moderator

2025-04-21T08:13:18.5333333+00:00

Hello @Martin Kallukalam,

Please note that we can pass email id, UPN, family_name, Onprem_sid, etc as a claim in ID token as well as Access token, but specifically we cannot pass the domain name as a claim in ID token and Access token.

Please note that the only way to get the domain names is to pass UPN/Email ID as Claims and get the domain name from that passed claims.

Please refer to the below documents to know in detail about Access tokens and ID tokens.

Access tokens in the Microsoft identity platform - Microsoft identity platform | Microsoft Learn

ID tokens in the Microsoft identity platform - Microsoft identity platform | Microsoft Learn

Tokens and claims overview - Microsoft identity platform | Microsoft Learn

I hope the above provided information is helpful. Please let me know if you have any additional queries.
Sanoop M 4,350 Reputation points Moderator

2025-04-22T12:11:32.2933333+00:00

Hello @Martin Kallukalam,

I am following up to check whether if you had a chance to review my below answer and please let me know if you have any queries.

I will be happy in answering to your queries.
Sanoop M 4,350 Reputation points Moderator

2025-04-23T08:56:44.97+00:00

Hello @Martin Kallukalam,

Since we didn't receive your response on my below answer, I am following up to check whether if you had a chance to review my below answer and please let me know if you have any queries.

I will be happy in answering to your queries.
Martin Kallukalam 535 Reputation points

2025-04-23T12:42:16.4066667+00:00

I did review the response and I do have couple of follow up Qs. I will post them shortly.
Sanoop M 4,350 Reputation points Moderator

2025-04-25T05:07:02.9933333+00:00

Hello @Martin Kallukalam,

Thank you for your response.

Please post your queries here so that I can review it and answer your queries accordingly.
Sanoop M 4,350 Reputation points Moderator

2025-04-28T03:25:15.5966667+00:00

Hello @Martin Kallukalam,

I am following up to check whether if you have any additional queries, please post your queries here so that I can look into it and answer your queries accordingly.
Martin Kallukalam 535 Reputation points

2025-04-29T19:13:36.7333333+00:00

When you say get the domain name from the passed claims..do you mean extract the domain name from claim in the application code?

Or does Azure AD have a way to do that and include the domainname as a claim?

How about the attribute user.dnsdomainname
Sanoop M 4,350 Reputation points Moderator

2025-05-06T13:28:49.73+00:00

Hello @Martin Kallukalam ,

Thank you for your response.

Yes the only way to get the domain name from the passed claims is to extract the domain names from the application code.

The user.dnsdomainname attribute typically refers to the domain name associated with the user's account in an On-Premises Active Directory. In authentication and authorization processes, particularly within federated identity solutions or Single Sign-On (SSO) setups, this attribute user.dnsdomainname can be passed in claims to identify the user's domain.

Below is the Screenshot of some of the attributes which can be passed in claims and their description. I have highlighted the description of the User.dnsdomainname attribute.

Please let me know if you have any other queries.
Martin Kallukalam 535 Reputation points

2025-05-06T18:03:58.68+00:00

If user.dnsdomainame is only reliable if the user gets authenticated via a federated system, how do I get the domain name when there is no federation, such as user identity is created on Azure AD and user is authenticating using those credential that exists on azure ad ?
Anonymous

2025-05-09T03:48:40.1266667+00:00

Hello @@Martin Kallukalam, Did you get a chance to verify my comment and let me know if its helpful?

We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution, please do share that same with the community as it can be helpful to others. Otherwise, please respond with more details and we will try to help.
Anonymous

2025-05-12T05:09:48.2266667+00:00

Hello @@Martin Kallukalam, Did you get a chance to verify my comment and let me know if its helpful?

We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution, please do share that same with the community as it can be helpful to others. Otherwise, please respond with more details and we will try to help.

Answer 1

Deleted

This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

6 deleted comments

Comments have been turned off. Learn more