Microsoft Entra IDAccess Token Claims Reference
In brief
| `exp` | int, a Unix timestamp | Specifies the expiration time before which the JWT can be accepted for processing. A resource may reject the token before this time as well. The rejection can occur for a required change in authentication or when a token is r…
Documentation change
| exp | int, a Unix timestamp | Specifies the expiration time before which the JWT can be accepted for processing. A resource may reject the token before this time as well. The rejection can occur for a required change in authentication or when a token is revoked. | |
| aio | Opaque String | An internal claim used by Microsoft Entra ID to record data for token reuse. Resources shouldn't use this claim. | |
| acr | String, a 0 or 1, only present in v1.0 tokens | A value of 0 for the "Authentication context class" claim indicates the end-user authentication didn't meet the requirements of ISO/IEC 29115. | |
| amr | JSON array of strings, only present in v1.0 tokens | Identifies the authentication method of the subject of the token. | |
| amr | JSON array of strings | Identifies the authentication method of the subject of the token. | |
| appid | String, a GUID, only present in v1.0 tokens | The application ID of the client using the token. The application can act as itself or on behalf of a user. The application ID typically represents an application object, but it can also represent a service principal object in Microsoft Entra ID. | appid may be used in authorization decisions. |
| azp | String, a GUID, only present in v2.0 tokens | A replacement for appid. The application ID of the client using the token. The application can act as itself or on behalf of a user. The application ID typically represents an application object, but it can also represent a service principal object in Microsoft Entra ID. | azp may be used in authorization decisions. |
| appidacr | String, a 0, 1, or 2, only present in v1.0 tokens | Indicates authentication method of the client. For a public client, the value is 0. When you use the client ID and client secret, the value is 1. When you use a client certificate for authentication, the value is 2. | |
diff --git a/docs/identity-platform/access-token-claims-reference.md b/docs/identity-platform/access-token-claims-reference.md index 9eed1b8b3ae..57501e33d51 100644 --- a/docs/identity-platform/access-token-claims-reference.md +++ b/docs/identity-platform/access-token-claims-reference.md @@ -49,7 +49,7 @@ The Microsoft identity platform uses some claims to help secure tokens for reuse | `exp` | int, a Unix timestamp | Specifies the expiration time before which the JWT can be accepted for processing. A resource may reject the token before this time as well. The rejection can occur for a required change in authentication or when a token is revoked. | | | `aio` | Opaque String | An internal claim used by Microsoft Entra ID to record data for token reuse. Resources shouldn't use this claim. | | | `acr` | String, a `0` or `1`, only present in v1.0 tokens | A value of `0` for the "Authentication context class" claim indicates the end-user authentication didn't meet the requirements of ISO/IEC 29115. | | -| `amr` | JSON array of strings, only present in v1.0 tokens | Identifies the authentication method of the subject of the token. | | +| `amr` | JSON array of strings | Identifies the authentication method of the subject of the token. | | | `appid` | String, a GUID, only present in v1.0 tokens | The application ID of the client using the token. The application can act as itself or on behalf of a user. The application ID typically represents an application object, but it can also represent a service principal object in Microsoft Entra ID. | `appid` may be used in authorization decisions. | | `azp` | String, a GUID, only present in v2.0 tokens | A replacement for `appid`. The application ID of the client using the token. The application can act as itself or on behalf of a user. The application ID typically represents an application object, but it can also represent a service principal object in Microsoft Entra ID. | `azp` may be used in authorization decisions. | | `appidacr` | String, a `0`, `1`, or `2`, only present in v1.0 tokens | Indicates authentication method of the client. For a public client, the value is `0`. When you use the client ID and client secret, the value is `1`. When you use a client certificate for authentication, the value is `2`. | |