title	Create customAuthenticationExtension
description	Create a new customAuthenticationExtension object.
author	soneff
ms.localizationpriority	medium
ms.subservice	entra-sign-in
doc_type	apiPageType
ms.date	01/09/2024

Create customAuthenticationExtension

Namespace: microsoft.graph

[!INCLUDE beta-disclaimer]

Create a new customAuthenticationExtension object. The following derived types are currently supported.

onTokenIssuanceStartCustomExtension resource type.
onAttributeCollectionStartCustomExtension resource type.
onAttributeCollectionSubmitCustomExtension resource type.
onOtpSendCustomExtension resource type.
onPasswordSubmitCustomExtension resource type.

Note

You can have a maximum of 100 custom extension policies.

[!INCLUDE national-cloud-support]

Permissions

Choose the permission or permissions marked as least privileged for this API. Use a higher privileged permission or permissions only if your app requires it. For details about delegated and application permissions, see Permission types. To learn more about these permissions, see the permissions reference.

[!INCLUDE permissions-table]

[!INCLUDE rbac-custom-auth-ext-apis-write]

HTTP request

POST /identity/customAuthenticationExtensions

Request headers

Name	Description
Authorization	Bearer {token}. Required. Learn more about authentication and authorization.
Content-Type	application/json. Required.

Request body

In the request body, supply a JSON representation of the customAuthenticationExtension object.

You can specify the following properties when creating a customAuthenticationExtension. You must specify the @odata.type property with a value of the customAuthenticationExtension object type that you want to create. For example, to create an onTokenIssuanceStartCustomExtension object, set @odata.type to #microsoft.graph.onTokenIssuanceStartCustomExtension.

Property	Type	Description
authenticationConfiguration	customExtensionAuthenticationConfiguration	The authentication configuration for this custom extension. Required.
behaviorOnError	customExtensionBehaviorOnError	Let to configure behavior if the call to custom authentication extension returns error. Optional.
clientConfiguration	customExtensionClientConfiguration	The connection settings for the custom extension. Optional.
description	String	Description for the custom extension. Inherited from customCalloutExtension. Optional.
displayName	String	Display name for the custom extension. Inherited from customCalloutExtension. Optional.
endpointConfiguration	customExtensionEndpointConfiguration	Configuration for the API endpoint that the custom extension will call. Inherited from customCalloutExtension. Optional.

Response

If successful, this method returns a 201 Created response code and a customAuthenticationExtension object in the response body.

Examples

Example 1: Create an onTokenIssuanceStartCustomExtension object

Request

The following example shows a request.

HTTP

POST https://graph.microsoft.com/beta/identity/customAuthenticationExtensions
Content-Type: application/json
Content-length: 468

{
    "@odata.type": "#microsoft.graph.onTokenIssuanceStartCustomExtension",
    "displayName": "onTokenIssuanceStartCustomExtension",
    "description": "Fetch additional claims from custom user store",
    "endpointConfiguration": {
        "@odata.type": "#microsoft.graph.httpRequestEndpoint",
        "targetUrl": "https://authenticationeventsAPI.contoso.com"
    },
    "authenticationConfiguration": {
        "@odata.type": "#microsoft.graph.azureAdTokenAuthentication",
        "resourceId": "api://authenticationeventsAPI.contoso.com/a13d0fc1-04ab-4ede-b215-63de0174cbb4"
    },
    "clientConfiguration": {
        "timeoutInMilliseconds": 2000,
        "maximumRetries": 1
    },
    "claimsForTokenConfiguration": [
        {
            "claimIdInApiResponse": "DateOfBirth"
        },
        {
            "claimIdInApiResponse": "CustomRoles"
        }
    ]
}

C#

[!INCLUDE sample-code] [!INCLUDE sdk-documentation]

Go

[!INCLUDE sample-code] [!INCLUDE sdk-documentation]

Java

[!INCLUDE sample-code] [!INCLUDE sdk-documentation]

JavaScript

[!INCLUDE sample-code] [!INCLUDE sdk-documentation]

PHP

[!INCLUDE sample-code] [!INCLUDE sdk-documentation]

PowerShell

[!INCLUDE sample-code] [!INCLUDE sdk-documentation]

Python

[!INCLUDE sample-code] [!INCLUDE sdk-documentation]

Response

The following example shows the response.

Note: The response object shown here might be shortened for readability.

HTTP/1.1 201 Created
Content-Type: application/json

{
    "@odata.context": "https://graph.microsoft.com/beta/$metadata#identity/customAuthenticationExtensions/$entity",
    "@odata.type": "#microsoft.graph.onTokenIssuanceStartCustomExtension",
    "id": "6fc5012e-7665-43d6-9708-4370863f4e6e",
    "displayName": "onTokenIssuanceStartCustomExtension",
    "description": "Fetch additional claims from custom user store",
    "clientConfiguration": null,
    "behaviorOnError": null,
    "authenticationConfiguration": {
        "@odata.type": "#microsoft.graph.azureAdTokenAuthentication",
        "resourceId": "api://authenticationeventsAPI.contoso.com/a13d0fc1-04ab-4ede-b215-63de0174cbb4"
    },
    "clientConfiguration": {
        "timeoutInMilliseconds": 2000,
        "maximumRetries": 1
    },
    "endpointConfiguration": {
        "@odata.type": "#microsoft.graph.httpRequestEndpoint",
        "targetUrl": "https://authenticationeventsAPI.contoso.com"
    },
    "claimsForTokenConfiguration": [
        {
            "claimIdInApiResponse": "DateOfBirth"
        },
        {
            "claimIdInApiResponse": "CustomRoles"
        }
    ]
}

Example 2: Create an onAttributeCollectionStartCustomExtension object

Request

The following example shows a request.

HTTP

POST https://graph.microsoft.com/beta/identity/customAuthenticationExtensions
Content-Type: application/json

{
  "@odata.type": "#microsoft.graph.onAttributeCollectionStartCustomExtension",
  "displayName": "attributeCollectionStartName",
  "description": "example description",
  "authenticationConfiguration": {
    "@odata.type": "#microsoft.graph.azureAdTokenAuthentication",
    "resourceId": "api://contoso.com/fb96de85-2abe-4b02-b45f-64ba122c509e"
  },
  "endpointConfiguration": {
    "@odata.type": "#microsoft.graph.httpRequestEndpoint",
    "targetUrl": "https://contoso.com"
  },
  "clientConfiguration": {
    "timeoutInMilliseconds": 2000,
    "maximumRetries": 1
  }
}

C#

[!INCLUDE sample-code] [!INCLUDE sdk-documentation]

Go

[!INCLUDE sample-code] [!INCLUDE sdk-documentation]

Java

[!INCLUDE sample-code] [!INCLUDE sdk-documentation]

JavaScript

[!INCLUDE sample-code] [!INCLUDE sdk-documentation]

PHP

[!INCLUDE sample-code] [!INCLUDE sdk-documentation]

PowerShell

[!INCLUDE sample-code] [!INCLUDE sdk-documentation]

Python

[!INCLUDE sample-code] [!INCLUDE sdk-documentation]

Response

The following example shows the response.

Note: The response object shown here might be shortened for readability.

HTTP/1.1 201 Created
Content-Type: application/json

{
    "@odata.context": "https://graph.microsoft.com/beta/$metadata#identity/customAuthenticationExtensions/$entity",
    "@odata.type": "#microsoft.graph.onAttributeCollectionStartCustomExtension",
    "id": "2d9c3e8d-88a9-444e-8c4c-f0c6c4fe1c02",
    "displayName": "attributeCollectionStartName",
    "description": "example description",
    "authenticationConfiguration": {
        "@odata.type": "#microsoft.graph.azureAdTokenAuthentication",
        "resourceId": "api://contoso.com/fb96de85-2abe-4b02-b45f-64ba122c509e"
    },
    "endpointConfiguration": {
        "@odata.type": "#microsoft.graph.httpRequestEndpoint",
        "targetUrl": "https://contoso.com"
    },
    "clientConfiguration": {
        "timeoutInMilliseconds": 2000,
        "maximumRetries": 1
    }
}

Example 3: Create an onAttributeCollectionSubmitCustomExtension object

Request

The following example shows a request.

HTTP

POST https://graph.microsoft.com/beta/identity/customAuthenticationExtensions
Content-Type: application/json

{
    "@odata.type": "#microsoft.graph.onAttributeCollectionSubmitCustomExtension",
    "displayName": "attributeCollectionSubmitName",
    "description": "example description",
    "authenticationConfiguration": {
        "@odata.type": "#microsoft.graph.azureAdTokenAuthentication",
        "resourceId": "api://contoso.com/fb96de85-2abe-4b02-b45f-64ba122c509e"
    },
    "endpointConfiguration": {
        "@odata.type": "#microsoft.graph.httpRequestEndpoint",
        "targetUrl": "https://contoso.com"
    },
    "clientConfiguration": {
        "timeoutInMilliseconds": 2000,
        "maximumRetries": 1
    }
}

C#

[!INCLUDE sample-code] [!INCLUDE sdk-documentation]

Go

[!INCLUDE sample-code] [!INCLUDE sdk-documentation]

Java

[!INCLUDE sample-code] [!INCLUDE sdk-documentation]

JavaScript

[!INCLUDE sample-code] [!INCLUDE sdk-documentation]

PHP

[!INCLUDE sample-code] [!INCLUDE sdk-documentation]

PowerShell

[!INCLUDE sample-code] [!INCLUDE sdk-documentation]

Python

[!INCLUDE sample-code] [!INCLUDE sdk-documentation]

Response

The following example shows the response.

Note: The response object shown here might be shortened for readability.

HTTP/1.1 201 Created
Content-Type: application/json

{
    "@odata.context": "https://graph.microsoft.com/beta/$metadata#identity/customAuthenticationExtensions/$entity",
    "@odata.type": "#microsoft.graph.onAttributeCollectionSubmitCustomExtension",
    "id": "66867d1f-7824-4f38-aad1-75da1ad09ee2",
    "displayName": "attributeCollectionSubmitName",
    "description": "example description",
    "authenticationConfiguration": {
        "@odata.type": "#microsoft.graph.azureAdTokenAuthentication",
        "resourceId": "api://contoso.com/fb96de85-2abe-4b02-b45f-64ba122c509e"
    },
    "endpointConfiguration": {
        "@odata.type": "#microsoft.graph.httpRequestEndpoint",
        "targetUrl": "https://contoso.com"
    },
    "clientConfiguration": {
        "timeoutInMilliseconds": 2000,
        "maximumRetries": 1
    }
}

Example 4: Create an onOtpSendCustomExtension object

Request

The following example shows a request.

HTTP

POST https://graph.microsoft.com/beta/identity/customAuthenticationExtensions
Content-Type: application/json

{
  "@odata.type": "#microsoft.graph.onOtpSendCustomExtension",
  "authenticationConfiguration": {
    "@odata.type": "#microsoft.graph.azureAdTokenAuthentication",
    "resourceId": "api://onotpsendcustomextension.b2c.expert/fb96de85-2abe-4b02-b45f-64ba122c509e"
  },
  "clientConfiguration": {
    "timeoutInMilliseconds": 2000,
    "maximumRetries": 1
  },
  "description": "Use an external Email provider to send OTP Codes.",
  "displayName": "onEmailOtpSendCustomExtension",
  "endpointConfiguration": {
    "@odata.type": "#microsoft.graph.httpRequestEndpoint",
    "targetUrl": "https://onotpsendcustomextension.b2c.expert/api/OnOTPCodeSendToTeamsDemo"
  },
  "behaviorOnError": {
    "@odata.type": "microsoft.graph.customExtensionBehaviorOnError"
  }
}

C#

[!INCLUDE sample-code] [!INCLUDE sdk-documentation]

Go

[!INCLUDE sample-code] [!INCLUDE sdk-documentation]

Java

[!INCLUDE sample-code] [!INCLUDE sdk-documentation]

JavaScript

[!INCLUDE sample-code] [!INCLUDE sdk-documentation]

PHP

[!INCLUDE sample-code] [!INCLUDE sdk-documentation]

PowerShell

[!INCLUDE sample-code] [!INCLUDE sdk-documentation]

Python

[!INCLUDE sample-code] [!INCLUDE sdk-documentation]

Response

The following example shows the response.

Note: The response object shown here might be shortened for readability.

HTTP/1.1 201 Created
Content-Type: application/json

{
  "@odata.type": "#microsoft.graph.onOtpSendCustomExtension",
  "authenticationConfiguration": {
    "@odata.type": "#microsoft.graph.azureAdTokenAuthentication",
    "resourceId": "api://onotpsendcustomextension.b2c.expert/fb96de85-2abe-4b02-b45f-64ba122c509e"
  },
  "clientConfiguration": {
    "timeoutInMilliseconds": 2000,
    "maximumRetries": 1
  },
  "description": "Use an external Email provider to send OTP Codes.",
  "displayName": "onEmailOtpSendCustomExtension",
  "endpointConfiguration": {
    "@odata.type": "#microsoft.graph.httpRequestEndpoint",
    "targetUrl": "https://onotpsendcustomextension.b2c.expert/api/OnOTPCodeSendToTeamsDemo"
  },
  "behaviorOnError": {
    "@odata.type": "microsoft.graph.customExtensionBehaviorOnError"
  }
}

FilesExpand file tree

identitycontainer-post-customauthenticationextensions.md

Latest commit

History

identitycontainer-post-customauthenticationextensions.md

File metadata and controls

Create customAuthenticationExtension

Permissions

HTTP request

Request headers

Request body

Response

Examples

Example 1: Create an onTokenIssuanceStartCustomExtension object

Request

Response

Example 2: Create an onAttributeCollectionStartCustomExtension object

Request

Response

Example 3: Create an onAttributeCollectionSubmitCustomExtension object

Request

Response

Example 4: Create an onOtpSendCustomExtension object

Request

Response