unable to read user custom attributes from /users/{oid} graph api

Question

I'm having trouble reading Azure AD B2C Custom User attributes via GET /users/{oid} graph api.

curl https://graph.windows.net/VishOrganizationB2CTenant.onmicrosoft.com/users/4a70b88f-2aa9-456c-b8e3-680bbd1bbf9f?api-version=1.6 -H "Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGci...."

Above cURL call doesn't return custom user attribute(s) in the response but I do get built-in user attributes in the response.

I even tried like this:

curl https://graph.windows.net/VishOrganizationB2CTenant.onmicrosoft.com/users/4a70b88f-2aa9-456c-b8e3-680bbd1bbf9f/extension_box_appuser_id?api-version=1.6 -H "Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGci..."

This returns error message:

{"odata.error":{"code":"Request_ResourceNotFound","message":{"lang":"en","value":"Resource 'extension_box_appuser_id' does not exist or one of its queried reference-property objects are not present."}}}

'box_appuser_id' is the custom user attribute I have added in Azure AD B2C tenant.

Can someone please guide me what I'm missing here?

Thanks, Vish

Answer 1

Based on the error message, it seems the extension property doesn't exits or incorrect. Please check whether the extension exits, you can refer the REST below to list all extension properties in the organization:

POST https://graph.windows.net/{tenant}/getAvailableExtensionProperties?api-version=1.6
authorization: bearer {access_token}
Content-Type: application/json

{
    "isSyncedFromOnPremises": false
}

Answer 2

A really simple way of making this happen

Using a standard policy create a custom atribute write to it during a policy Go into graph and fetch the object that you just wrote this will give you the correct format extension_guid_name

for example extension_123132131231233213_name.

When you create these claims in the policy the claim id should be

extension_name.

If you want to return these then you need to use the B2C Extension app (found in Azure AD) as the identity app to connect to in your custom policies.

In your meta data for your AD technical profile your b2c_extension_app_guild must be

</Metadata>
   <Item Key="ApplicationObjectId">App Object ID</Item>
   <Item Key="ClientId">B2C_extension_app_guid </Item>
</Metadata>