Newly Created Custom Claims Providers don't trigger

Hello Marc Jordan

Can you please confirm if you have followed the steps mentioned here https://stackoverflow.com/questions/77060652/how-do-i-add-claims-from-my-custom-claims-provider-to-entra-external-id-azure-ad

If still the issue persists, the issue might be due to odata.type and the content-type header:

import { AzureFunction, Context, HttpRequest } from "@azure/functions"
const httpTrigger: AzureFunction = async function (context: Context, req: HttpRequest): Promise<void> {
    //context.log('HTTP trigger function processed a request.');
    const correlationId = (req.body && req.body.data.authenticationContext.correlationId)
    const response =
        {
            "data": {
                "@odata.type": "microsoft.graph.onTokenIssuanceStartResponseData",
                "actions": [
                    {
                        "@odata.type": "microsoft.graph.provideClaimsForToken",
                        "claims": {
                            "correlationId": `${correlationId}`,
                            "organization": "myorg",
                            "apiVersion": "1.0.0"
                        }
                    }
                ]
            }
        };
    context.res = {
        // status: 200, /* Defaults to 200 */
        body: response,
        headers: {
            'Content-Type': 'application/json'
        }
    };
};
export default httpTrigger;

References:

https://learn.microsoft.com/en-us/entra/identity-platform/custom-extension-tokenissuancestart-setup?tabs=visual-studio%2Cazure-portal&pivots=azure-portal

https://learn.microsoft.com/en-us/entra/identity-platform/custom-extension-tokenissuancestart-configuration?tabs=azure-portal%2Cworkforce-tenant

Let me know if any further queries - feel free to reach out!

Correct -- it's the same service on the backend, with identical url's to get there.

The backend (when actually called) returns the claims needed, however only one Claim Provider actually calls to the backend. The other (even after matching the config exactly) does not call to the backend. I see no request logs on the back-end service on the broken custom claims provider, but I see them on the working CCP.

• What server‑side state (replication, indexing, secondary cache, internal id mapping, etc.) determines whether Entra resolves a customAuthenticationExtension at token issuance time, and how can I refresh / rebuild it without deleting and recreating the extension and re‑onboarding consumers?
• Is there a known issue affecting CCPs created on or around 2026‑05‑25 in Entra tenants?

Hello Marc Jordan

Rather than backend, consent, or endpoint settings, this behavior is the result of a stale or missing internal runtime binding in Entra's authentication event listener execution graph.

The listener is unable to resolve the custom authentication extension into its execution graph since Entra fails at pre-runtime resolution time, despite Graph and validateAuthenticationConfiguration showing the extension as correctly configured. This explains why you observe:

1. customExtensionId = 00000000-0000...
2. numberOfAttempts = 0
3. ExtensionNotFound
4. No HTTP call to the backend

This means that execution is skipped before any callout because the extension is present in the directory but is not visible in the token issuance runtime cache/index.

To fix the issue:

Trigger a runtime graph refresh by doing one of the following:

• Make a no-op update to the authenticationEventListener (e.g., toggle priority or re-save conditions)
• Or temporarily disable and re-enable the listener/extension

This usually fixes the problem without rebuilding the extension and requires Entra to reconstruct the internal binding graph.

This is consistent with a known eventual consistency/stale binding graph behavior in custom authentication extensions; no known tenant-specific or date-specific (2026-05-25) product issue has been found.

Thanks Rukmini,

The below is the authenticationEventListener object I am working with -- I don't see a priority or conditions field on the object.

{
    "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#identity/authenticationEventListeners/$entity",
    "@odata.type": "#microsoft.graph.onTokenIssuanceStartListener",
    "@microsoft.graph.tips": "Use $select to choose only the properties your app needs, as this can lead to performance improvements. For example: GET identity/authenticationEventListeners('<guid>')?$select=authenticationEventsFlowId,conditions",
    "id": "9a3534...",
    "displayName": null,
    "authenticationEventsFlowId": null,
    "conditions": {
        "applications": {
            "includeApplications@odata.context": "https://graph.microsoft.com/v1.0/$metadata#identity/authenticationEventListeners('9a3534...')/microsoft.graph.onTokenIssuanceStartListener/conditions/applications/includeApplications",
            "includeApplications": [
                {
                    "appId": "0eb42bd..."
                }
            ]
        }
    },
    "handler": {
        "@odata.type": "#microsoft.graph.onTokenIssuanceStartCustomExtensionHandler",
        "configuration": null,
        "customExtension": {
            "id": "9d1d12...",
            "displayName": "Name",
            "description": null,
            "behaviorOnError": null,
            "authenticationConfiguration": {
                "@odata.type": "#microsoft.graph.azureAdTokenAuthentication",
                "resourceId": "api://entra-hook-debug-.../634db21..."
            },
            "endpointConfiguration": {
                "@odata.type": "#microsoft.graph.httpRequestEndpoint",
                "targetUrl": "https://entra-hook-debug-5..."
            },
            "clientConfiguration": {
                "timeoutInMilliseconds": 1999,
                "maximumRetries": 1
            },
            "claimsForTokenConfiguration": [
                {
                    "claimIdInApiResponse": "Role"
                }
            ]
        }
    }
}

Instead I updated the timeout from 2000ms to 1999ms, should this no-op update also solve the issue? I'm still not seeing success.

Hello Marc Jordan

Nothing is missing from your listener response because it has the conditions field (under conditions.applications.includeApplications).

Regarding the timeout change (2000 → 1999 ms):

This will not act as a valid no-op to refresh or rebind the custom extension, so it is expected that the issue still persists.

The problem is not configuration-related, but rather a stale internal binding/index between the listener and the customAuthenticationExtension, since runtime continues to display ExtensionNotFound and customExtensionId = 00000000....

you need to force a proper rebind of the listener to the extension (detach/reattach or re-save the handler), not just metadata updates.

This should trigger Entra to rebuild the runtime resolution graph and start the HTTP callout.