Microsoft Entra ID

This guide covers how to configure Microsoft Entra ID (formerly Azure Active Directory) as a third-party identity provider for Shopify customer accounts, including how to add custom claims to your ID tokens for customer data enrichment.

Shopify includes built-in handling for Entra ID's non-standard OIDC behavior, including email claim mapping and email verification.

Anchor to PrerequisitesPrerequisites

• A Shopify Plus plan with new customer accounts enabled.
• A Microsoft Entra tenant with an App Registration created.
• Token version set to v2.0: in the App Registration manifest, set accessTokenAcceptedVersion to 2.

Anchor to Connect Entra ID to ShopifyConnect Entra ID to Shopify

To connect Microsoft Entra ID as your store's identity provider, you'll add your Entra ID credentials to the Shopify admin and configure your App Registration to accept Shopify's callback URL.

Anchor to Step 1: Add your Entra ID credentials in the Shopify adminStep 1: Add your Entra ID credentials in the Shopify admin

Add your Discovery URL, Application (client) ID, and Client Secret in the Shopify admin under Settings > Customer accounts > Third-party identity provider. Select Microsoft Entra ID as the provider type.

You can find these values in the Microsoft Entra admin center:

• Discovery URL: https://login.microsoftonline.com/{tenant-id}/v2.0/.well-known/openid-configuration.
• Application (client) ID: Found on the Overview page of your App Registration.
• Client Secret: Create one under Certificates & secrets > Client secrets.

For full setup instructions, refer to Connect a third-party identity provider.

Anchor to Step 2: Add your Shopify callback URL to Entra IDStep 2: Add your Shopify callback URL to Entra ID

To complete the connection, add your Shopify callback URL as a Redirect URI under Authentication in your App Registration. This lets Entra ID redirect customers back to your store after they authenticate.

You can find your Shopify callback URL in the Shopify admin on the same Third-party identity provider settings page from Step 1.

Anchor to Standard claimsStandard claims

Entra ID doesn't include profile claims in ID tokens by default. To import names and email, you need to add them as optional claims:

1. In the Entra admin center, go to your App Registration > Token configuration.
2. Click Add optional claim and select ID as the token type.
3. Add the following claims: given_name, family_name, email.
4. When prompted, consent to the required Microsoft Graph permissions.

For more details, refer to Configure optional claims.

Anchor to Add custom Shopify claimsAdd custom Shopify claims

Adding custom claims in Entra ID is more involved than in Auth0 or Okta. The approach depends on the complexity of the claim.

Anchor to Tags (simple claims)Tags (simple claims)

For simple string claims like urn:shopify:customer:tags, use a Claims Mapping Policy:

1. In the App Registration manifest, set acceptMappedClaims to true. This is required for Claims Mapping Policies to work.
2. Create a Claims Mapping Policy using Microsoft Graph or PowerShell that maps a user attribute or directory extension to the urn:shopify:customer:tags claim in the ID token.

Anchor to Addresses (complex claims)Addresses (complex claims)

For structured data like urn:shopify:customer:addresses, use a Custom Authentication Extension with the TokenIssuanceStart event type:

1. Create an Azure Function or API endpoint that returns address data in the Shopify address format.
2. In the Entra admin center, go to Custom authentication extensions and create a new extension with the TokenIssuanceStart event type.
3. Configure the extension to call your API endpoint and map the response attributes to token claims.
4. Assign the custom attributes as token claims in your App Registration under Token configuration.

This approach is more involved than other providers. If you're getting started with customer data enrichment, consider beginning with standard claims (name, email) and tags before implementing address import.

For more details, refer to Configure a custom claims provider.

Anchor to Enable enrichment in ShopifyEnable enrichment in Shopify

After configuring your identity provider to include custom claims, you need to tell Shopify to read and import them.

In the Shopify admin under your identity provider settings, enable Sync customer data and configure the update trigger and overwrite rules. For details on these options, refer to claim import configuration.

Anchor to VerifyVerify

After enabling enrichment, verify that your claims are included in the ID token and that Shopify imports them correctly:

1. Use jwt.ms to decode your ID token and verify that custom claims are present before testing on Shopify.
2. Authenticate on your store through Entra ID.
3. In the Shopify admin, go to Customers and open the customer record to confirm the imported data.

Anchor to TroubleshootingTroubleshooting

Anchor to ResourcesResources

• Microsoft: Configure optional claims
• Microsoft: Claims customization
• Microsoft: Custom claims provider configuration
• Microsoft: ID token claims reference
• Microsoft: Register an application
• Shopify: Claim import reference