Azure Entra | for external user login Missing upn from the token

Configure the upn access-token claim on the app registration representing the API in the token’s aud claim—not only on the OpenText client registration—and enable Externally authenticated for external users.

Correct the access-token configuration

1. Decode the Bearer [Token] and inspect:
   • aud: identifies the API/resource for which the token was issued.
   • ver: identifies the token format, typically 1.0 or 2.0.
   • oid and tid: use these as the stable user and tenant identifiers.
2. In the Microsoft Entra admin center, go to: Entra ID → App registrations → API registration matching aud → Token configuration
3. Under the existing upn claim:
   • Ensure it was added for Access, not only ID.
   • Select the pencil/edit icon.
   • Enable Externally authenticated.
   • Save the configuration.

Access-token optional claims are controlled by the resource API registration, even when another application—such as OpenText—requests the token. ID-token claims are controlled by the client application registration.^1^

The equivalent API manifest entry is:

"optionalClaims": {
  "accessToken": [
    {
      "name": "upn",
      "essential": false,
      "additionalProperties": [
        "include_externally_authenticated_upn"
      ]
    }
  ]
}

For an ID token, place the same claim under idToken instead. The external-user setting emits the guest UPN stored in the resource tenant, normally in a form such as user_domain.com#EXT#@tenant.onmicrosoft.com.^2^ A B2B guest object's UPN uses this resource-tenant representation rather than necessarily reproducing the sign-in email or home-tenant UPN.^3^

Request a completely new token after saving; an already-issued Bearer [Token] is not modified.

If this is a v2.0 token

Include the OIDC profile scope in the authorization request. For v2.0 tokens, upn requires profile; for displaying a username, preferred_username is the recommended claim.^2^

Do not use either upn, preferred_username, or email as an authorization key because these values can change. Use the combination of oid and tid to associate the external account with an application record.

If UPN is still absent

Determine which system issued the inspected token by checking iss:

• Microsoft Entra issued the Bearer [Token]: verify that its aud matches the API registration where the Access optional claim was configured. Configuring the OpenText client registration does not alter an access token issued for a different API.
• OpenText issued the token directly: Entra optional-claim configuration does not control that token. Configure OpenText’s claim mapping instead.
• OpenText is federated as an external OIDC identity provider: OpenText sends an ID token to External ID, and External ID subsequently issues a separate token to the application. The partner’s complete token is not passed through automatically; the required source attribute must be returned by OpenText, mapped into External ID, and selected for the application token.^4^

If the application only needs a readable sign-in name, map preferred_username or an appropriate email attribute instead of requiring UPN. If it requires the resource tenant's guest UPN specifically, retain upn with include_externally_authenticated_upn.

References

1. Configure and manage optional claims in ID tokens, access tokens, and SAML tokens
2. Optional claims reference
3. Understand and manage the properties of B2B guest users
4. Identity verification integration overview for Microsoft Entra External ID