Microsoft authentication setup issues with incomplete guide

For the name claim, I tried with the Kinde default Microsoft app (ie: not entering my client ID/secret).
I am getting the same result.

My test account has its name set on account.microsoft.com and it’s not a 365 account.

Hey ,
Thanks for raising all these incomplete or eronous issues in the Microsoft social sign in doc. We constantly test out the social connections by following our guides and consume notifications on the social identity but sometimes things change on the social provider side before we can change the docs or things on our side - since changes on the social identity side are out of our control.

I will review all the issues you mentioned with my team and get back to you.

Hey ,
Regarding your issue (#4) where you cannot get the name claims (name, family_name and given_name), I was not able to reproduce your issue. I signed-up with a Microsoft social connection using Kinde default app keys and the claims in the ID token were populated with the correct name, family_name and given_name claims.

Are you able to check your Microsoft profile does have a name against it?

Regarding your points #1-3, my expert Microsoft social connection is offline today but I will get them to look into this on Monday.

That’s what I have on accounts.microsoft.com and on Azure users

Hey ,
Thanks for the quick reply and sending the screenshots. I can see you do indeed have your name against your Microsoft profile.

Would you be able to do the following:

1. Go to the Kinde Admin
2. Go to your Kinde application -> Tokens -> Token customization
3. Select customize on the ID Token card
4. Enable Social identity (string)
5. Inspect the ID token and let me know if there is value for the claims family_name, given_name, displayName, givenName and surname under the ext_provider claim?

• From the application home
• Go to Manage -> Token configuration
• Click Add optional claim
• Select proper claims (would need your confirmation on needed ones here) I select email, given_name, family_name, verified_primary_email, verified_secondary_email for both access and ID token
• Go to Manage -> Authentication
• In “Implicit grant and hybrid flows”, select both Access tokens and ID tokens.

Thanks for the reply Oli,
Social identity is enabled. I’m currently testing on the default Kinde tenant and not on my own OAuth2 tenant.

Here is my ID token payload, indeed the name data is missing

{
  "at_hash": "EOAHI_UOCS6Xh9VfA9FHHQ",
  "aud": [
    "dc2e6ea7858d418a87d86fff5012ed7e"
  ],
  "auth_time": 1727339513,
  "azp": "dc2e6ea7858d418a87d86fff5012ed7e",
  "email": "noe.charmet@shipfox.io",
  "email_verified": true,
  "exp": 1727420822,
  "ext_provider": {
    "claims": {
      "connection_id": "06ecdd0ec6cf464a97d9f7e67b7d2261",
      "email": "noe.charmet@shipfox.io",
      "family_name": "",
      "given_name": "",
      "is_confirmed": true,
      "picture": "<a target="_blank" rel="noopener noreferrer" href="https://gravatar.com/avatar/0a418f6b404ae1b1d75e79eb66676f5bfc298a780afb6e3a6bb58d3adcaca7d6?d=blank&size=200">https://gravatar.com/avatar/0a418f6b404ae1b1d75e79eb66676f5bfc298a780afb6e3a6bb58d3adcaca7d6?d=blank&size=200</a>",
      "profile": {
        "@odata.context": "<a target="_blank" rel="noopener noreferrer" href="https://graph.microsoft.com/v1.0/$metadata#users/$entity">https://graph.microsoft.com/v1.0/$metadata#users/$entity</a>",
        "businessPhones": [],
        "displayName": " ",
        "givenName": "",
        "id": "1c5779b15558d76f",
        "mail": "noe.charmet@shipfox.io",
        "preferredLanguage": "en-US",
        "surname": "",
        "userPrincipalName": "noe.charmet@shipfox.io"
      }
    },
    "connection_id": "06ecdd0ec6cf464a97d9f7e67b7d2261",
    "name": "Microsoft"
  },
  "family_name": "",
  "given_name": "",
  "iat": 1727417222,
  "iss": "<a target="_blank" rel="noopener noreferrer" href="https://auth.shipfox.io">https://auth.shipfox.io</a>",
  "jti": "5135a265-90ea-4edb-bfbd-b80d706d2137",
  "name": "",
  "picture": "<a target="_blank" rel="noopener noreferrer" href="https://gravatar.com/avatar/0a418f6b404ae1b1d75e79eb66676f5bfc298a780afb6e3a6bb58d3adcaca7d6?d=blank&size=200">https://gravatar.com/avatar/0a418f6b404ae1b1d75e79eb66676f5bfc298a780afb6e3a6bb58d3adcaca7d6?d=blank&size=200</a>",
  "rat": 1727339513,
  "sub": "kp_32a118e6f5124136b7c867ae2fd2601c",
  "updated_at": 1727339513
}

Hey ,
Very odd.
It looks like no name details are added to the ext_provider claim. The details under the ext_provider claim are basically all the details Kinde gets back, through OAuth2.0, from Microsoft.

What SDK are you using and what version?
Can you confirm if the profile scope (see here) is added to your environment?

I’m using the React JS SDK.
When you mean my environement, do you mean on Azure ? I’m currently testing with the default Kinde app which sould be using your own Azure connection.
However here are the OpenID claims API permissions I have on my side.

Thanks for sharing this.
Are you able to try overriding the scopes in your React setup and include the profile scope? - see here

Same result when overriding scope.
Honestly I think it’s more to do with my Microsoft account setup than a Kinde issue per-se. However I really can’t figure out where the problem is at this point.
Let me escalate this to Azure and see what they say first.

We’re not using Microsoft 365 or Azure AD per-se. I guess that what I have is just a regular Microsoft user account, could this have an impact here?

Nope this shouldn't have any impact.
Please let me know what Azure say. We are here to help