Setting up Entra External ID Custom Authentication Extension, getting AADSTS1100001

Hello David Harbert

Thank you for reaching out to Microsoft Q&A.

An error of AADSTS1100001 indicates that there was an issue with the use of the custom claims provider/custom extension. Along with Azure Functions, you can check the sign-in logs under the 'Authentication events' tab to know the exact error. I wanted to check if you are trying to add custom claim provider in Azure and get claims out of it?

Could you please share the detailed code part as well.

For your reference: https://learn.microsoft.com/en-us/entra/identity-platform/custom-extension-troubleshoot?tabs=api-testing-tools

For your reference: https://learn.microsoft.com/en-us/entra/identity-platform/custom-extension-overview

Here is my token_issuance_start. While troubleshooting, just hardcoding the claim value.

When I test using Postman, my reponse is

{
    "data": {
        "@odata.type": "microsoft.graph.onTokenIssuanceStartResponseData",
        "actions": [
            {
                "@odata.type": "microsoft.graph.tokenIssuanceStart.provideClaimsForToken",
                "claims": {
                    "coraUserId": "12345"
                }
            }
        ]
    }
}

# File: functions/functions_http/system/token_issuance_start.py
# -*- coding: utf-8 -*-

"""Handle Microsoft Entra External ID token enrichment callbacks."""

from __future__ import annotations

import json
import uuid
from typing import Any, Dict

from azure.functions import HttpRequest, HttpResponse
from utils_common.log import get_log
from utils_common_ciam.constants import HEADER_OPERATION_ID

log = get_log(__name__)

TOKEN_ENRICHMENT_CLAIM_NAME = "coraUserId"
"""Claim name injected into tokens during enrichment."""


def _token_response(claims: Dict[str, Any], *, operation_id: str | None = None) -> HttpResponse:
    """Return a token issuance start response with the expected schema."""

    headers: Dict[str, str] = {}
    if operation_id:
        headers[HEADER_OPERATION_ID] = operation_id

    body = {
        "data": {
            "@odata.type": "microsoft.graph.onTokenIssuanceStartResponseData",
            "actions": [
                {
                    "@odata.type": "microsoft.graph.tokenIssuanceStart.provideClaimsForToken",
                    "claims": claims,
                }
            ],
        }
    }

    return HttpResponse(
        body=json.dumps(body),
        status_code=200,
        mimetype="application/json",
        headers=headers,
    )


async def token_issuance_start(req: HttpRequest) -> HttpResponse:
    """Return a fixed claim for token issuance start callbacks."""

    operation_id = req.headers.get(HEADER_OPERATION_ID) or str(uuid.uuid4())

    try:
        _ = req.get_json()
    except ValueError:
        log.warning("token_issuance_start_invalid_json", extra={"operation_id": operation_id})

    claims = {TOKEN_ENRICHMENT_CLAIM_NAME: "12345"}
    log.info("token_issuance_start_claim_emitted", extra={"operation_id": operation_id})
    return _token_response(claims, operation_id=operation_id)


__all__ = ["token_issuance_start"]

Sign-in logs on the "Test Application" Enterprise app says basically same as this

AADSTS1100001: Non-retryable error has occurred. Underlying error code: 1003005. Trace ID: c1f17916-4a7b-4b72-bf63-879d17b60300 Correlation ID: d157d879-36df-4eab-ab15-4f6bab412deb Timestamp: 2025-11-21 20:07:36Z

Posted in wrong area.