Microsoft Entra ID

Optional Claims

12 August 2026Updated+72 / −3 lines

In brief

The documentation now explains how to configure granular AMR values for SAML applications through the manifest or Microsoft Graph, since the admin center has no UI option for `include_granular_amr`. It also documents adding the `amr` claim to OIDC token types and clarifies that `include_granular_amr` applies only to SAML.

What Entra admins need to know

Administrators who need granular AMR values must use the application manifest or Microsoft Graph and preserve existing optional-claim settings; OIDC applications only need the `amr` optional claim.

This editorial summary was generated by AI from the documentation changes. Verify important details in the full Microsoft Learn article.

Documentation change

View full page diff

View on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

When you're finished updating the manifest, select Save to save the manifest.

amrAMR claim

The amr (authentication method references) claim identifies how the user authenticated. The amr claim is sent by default for Salesforce applications, so no configuration change is required for those apps. For all other SAML applications, the application administrator must add the optional amr claim with the include_granular_amr additional property to the app registration to request AMR claims. The multipleauthn and mfa values are emitted only when the user has completed MFA.

Configure granular AMR values for a SAML application

The Microsoft Entra admin center doesn't currently provide a UI option for include_granular_amr. Configure this property in the application manifest or by using Microsoft Graph. The include_granular_amr property modifies the amr claim to emit granular authentication method values in SAML tokens.

To configure the application manifest:

In the Microsoft Entra admin center, browse to Entra ID > App registrations.
Select the app registration.
Under Manage, select Manifest.

Add or update the optionalClaims property with the following configuration. Preserve any existing optional claims that your application requires.

"optionalClaims": {
    "saml2Token": [
        {
            "name": "amr",
            "essential": false,
            "additionalProperties": [
                "include_granular_amr"
            ]
        }
    ]
}

Select Save.

Alternatively, use the Microsoft Graph Update application API. Replace {applicationObjectId} with the object ID of the application registration. Include any existing optional claim configuration that you want to retain in the request body.

PATCH https://graph.microsoft.com/v1.0/applications/{applicationObjectId}
Content-Type: application/json

{
    "optionalClaims": {
        "saml2Token": [
            {
                "name": "amr",
                "essential": false,
                "additionalProperties": [
                    "include_granular_amr"
                ]
            }
        ]
    }
}

For ~~SAML,~~more information about the SAML claim, see authnmethodreferences.

Configure the AMR claim for more details.an OIDC application

For an OpenID Connect (OIDC) v2.0 application, add the amr optional claim to the token types that your application requires. The include_granular_amr property applies only to SAML applications and isn't required for OIDC applications. The following application manifest requests the amr claim in both ID and access tokens:

"optionalClaims": {
    "idToken": [
        {
            "name": "amr",
            "essential": false
        }
    ],
    "accessToken": [
        {
            "name": "amr",
            "essential": false
        }
    ]
}

Limitation

@@ -3,7 +3,7 @@ title: Configure optional claims description: Learn how to configure optional claims and attributes in access tokens issued by Microsoft identity platform; optional claims can add useful user information for your app. manager: pmwongera ms.custom:-ms.date: 07/22/2026+ms.date: 08/11/2026 ms.reviewer: ludwignick ms.service: identity-platform ai-usage: ai-assisted@@ -311,11 +311,80 @@ Configure claims in the manifest:  1. When you're finished updating the manifest, select **Save** to save the manifest. -## amr claim+## AMR claim  The `amr` (authentication method references) claim identifies how the user authenticated. The `amr` claim is sent by default for Salesforce applications, so no configuration change is required for those apps. For all other SAML applications, the application administrator must add the optional `amr` claim with the `include_granular_amr` additional property to the app registration to request AMR claims. The `multipleauthn` and `mfa` values are emitted only when the user has completed MFA. -For SAML, see [authnmethodreferences](single-sign-on-saml-protocol.md#authnmethodreferences) for more details.+### Configure granular AMR values for a SAML application++The Microsoft Entra admin center doesn't currently provide a UI option for `include_granular_amr`. Configure this property in the application manifest or by using Microsoft Graph. The `include_granular_amr` property modifies the `amr` claim to emit granular authentication method values in SAML tokens.++To configure the application manifest:++1. In the [Microsoft Entra admin center](https://entra.microsoft.com), browse to **Entra ID** > **App registrations**.+1. Select the app registration.+1. Under **Manage**, select **Manifest**.+1. Add or update the `optionalClaims` property with the following configuration. Preserve any existing optional claims that your application requires.++    ```json+    "optionalClaims": {+        "saml2Token": [+            {+                "name": "amr",+                "essential": false,+                "additionalProperties": [+                    "include_granular_amr"+                ]+            }+        ]+    }+    ```++1. Select **Save**.++Alternatively, use the Microsoft Graph [Update application](/graph/api/application-update) API. Replace `{applicationObjectId}` with the object ID of the application registration. Include any existing optional claim configuration that you want to retain in the request body.++```http+PATCH https://graph.microsoft.com/v1.0/applications/{applicationObjectId}+Content-Type: application/json++{+    "optionalClaims": {+        "saml2Token": [+            {+                "name": "amr",+                "essential": false,+                "additionalProperties": [+                    "include_granular_amr"+                ]+            }+        ]+    }+}+```++For more information about the SAML claim, see [authnmethodreferences](single-sign-on-saml-protocol.md#authnmethodreferences).++### Configure the AMR claim for an OIDC application++For an OpenID Connect (OIDC) v2.0 application, add the `amr` optional claim to the token types that your application requires. The `include_granular_amr` property applies only to SAML applications and isn't required for OIDC applications. The following application manifest requests the `amr` claim in both ID and access tokens:++```json+"optionalClaims": {+    "idToken": [+        {+            "name": "amr",+            "essential": false+        }+    ],+    "accessToken": [+        {+            "name": "amr",+            "essential": false+        }+    ]+}+```  ## Limitation